{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-28387 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-28387 is a high-severity use after free vulnerability in Openssl Openssl, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-28387 and fix it if it is affected.\n\nWhat it is: CVE-2026-28387 is a high-severity use after free vulnerability in Openssl Openssl, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-28387 in the wild and no public exploit code.\n\nAffected product: Openssl Openssl. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-28387/ (Markdown: https://insights.sbomify.com/CVE-2026-28387/index.md)","id":"CVE-2026-28387","markdown":"https://insights.sbomify.com/CVE-2026-28387/index.md","name":"CVE-2026-28387","record":{"aliases":["ALPINE-CVE-2026-28387","AZL-81947","AZL-82103","BELL-CVE-2026-28387","CLSA-2026-1777455447","CLSA-2026-1777542789","CLSA-2026-1777567502","DEBIAN-CVE-2026-28387","ECHO-6fc6-4872-7ea8","GHSA-h2cc-wx97-xp8v","JLSEC-2026-272","MINI-g2v9-6998-mmpm","MINI-j8h3-pj3q-rjj2","MINI-rfjw-6mc7-895q","ROOT-OS-ALPINE-315-CVE-2026-28387","ROOT-OS-ALPINE-317-CVE-2026-28387","UBUNTU-CVE-2026-28387"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"OpenSSL library","requires_auth":"none","summary":"A use-after-free in OpenSSL's DANE client code allows arbitrary code execution or crashes when specific TLSA record combinations are used.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"openssl","cpe":[{"product":"openssl","vendor":"openssl"}],"cvss":{"score":8.1,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Potential Use-after-free in DANE Client Code","id":"CVE-2026-28387","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"openssl:openssl","products":["openssl:openssl"],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":6,"next":{"headline":"NULL Pointer Dereference When Processing a Delta CRL","id":"CVE-2026-28388"},"packages":[],"prev":{"headline":"Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support","id":"CVE-2026-28386"},"products":["OpenSSL"],"published":"2026-04-07","related":[{"cvss_score":10,"headline":"Null dereference in n/a","id":"CVE-2009-3245","kev_date_added":null,"published":"2010-03-05"},{"cvss_score":10,"headline":"Memory corruption in n/a","id":"CVE-2006-3738","kev_date_added":null,"published":"2006-09-28"},{"cvss_score":9.8,"headline":"Untrusted Sender DN Used as Format String in CMP Response Validation","id":"CVE-2026-63073","kev_date_added":null,"published":"2026-08-25"},{"cvss_score":9.8,"headline":"Use after free in n/a","id":"CVE-2016-6309","kev_date_added":null,"published":"2016-09-26"},{"cvss_score":9.8,"headline":"Integer overflow in n/a","id":"CVE-2016-0799","kev_date_added":null,"published":"2016-03-03"},{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2016-2842","kev_date_added":null,"published":"2016-03-03"},{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2003-0545","kev_date_added":null,"published":"2003-10-01"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-15","vendors":["OpenSSL"]},"summary":"A use-after-free in OpenSSL's DANE client code allows arbitrary code execution or crashes when specific TLSA record combinations are used.","url":"https://insights.sbomify.com/CVE-2026-28387/"}