CVE-2026-72897

A flaw was found in openssl. When a server replaces its security context during an active Transport Layer Security (TLS) handshake, it fails to update the internal capacity tracking for cryptographic signature algorithms. A remote peer can exploit this issue by advertising specific signature algorithms, causing out-of-bounds memory reads and writes on the server heap. This vulnerability can corrupt internal memory and terminate the process, resulting in a Denial of Service (DoS).

This issue is rated Moderate because a TLS server that calls SSL_set_SSL_CTX() mid-handshake can suffer a small out-of-bounds read/write if the replacement context exposes more provider signature algorithms than the original, which may crash the process. Applications that never call SSL_set_SSL_CTX() are not affected; the configuration is uncommon and not default.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid calling SSL_set_SSL_CTX() during an active handshake unless required (for example SNI virtual hosts). Ensure original and replacement SSL_CTX instances are created with consistent provider/signature-algorithm configuration.