CVE-2026-28387

A flaw was found in OpenSSL. An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. This vulnerability could lead to data corruption, application crashes, or, in severe cases, arbitrary code execution. This issue is highly specific and uncommon, as it only affects clients using both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages and communicating with a server publishing a TLSA record set with both types of records.

This Low impact vulnerability affects clients performing DANE TLSA-based server authentication only when configured with an uncommon combination of PKIX-TA(0/PKIX-EE(1) and DANE-TA(2) certificate usages. Most common SMTP MTA deployments are not vulnerable as they are recommended to treat PKIX certificate usages as unusable. Exploitation also requires communication with a server publishing a TLSA RRset with both types of records

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.