CVE-2026-28387

Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable. The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records. No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.

• CWE-416

• https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012bPatch
• https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbePatch
• https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3Patch
• https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7Patch
• https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177Patch
• https://openssl-library.org/news/secadv/20260407.txtVendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html

Published

Apr 7, 2026

Last Modified

Jul 24, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28380Any Editor could delete any snapshot, even if they have no a…6.5
• CVE-2026-28381The Snowflake datasource allows for GET/PUT commands, which …8.1
• CVE-2026-28383A request to the Grafana plugin resources endpoint can cause…6.5
• CVE-2026-28384An improper sanitization of the compression_algorithm parame…9.4
• CVE-2026-28385In Canonical LXD versions 4.12 through 6.9, a Server-Side Re…5
• CVE-2026-28386Issue summary: Applications using AES-CFB128 encryption or d…7.5
• CVE-2026-28388Issue summary: When a delta CRL that contains a Delta CRL In…7.5
• CVE-2026-28389Issue summary: During processing of a crafted CMS EnvelopedD…7.5
• CVE-2026-28390Issue summary: During processing of a crafted CMS EnvelopedD…7.5
• CVE-2026-28391OpenClaw versions prior to 2026.2.2 fail to properly validat…9.8
• CVE-2026-28392OpenClaw versions prior to 2026.2.14 contain a privilege esc…9.8
• CVE-2026-28393OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a p…9.8