Executive brief
OpenSSL is a widely used security library that secures internet communications. A flaw in certain versions may cause a server to choose a weaker encryption method than intended, even when stronger options like post-quantum cryptography are available. This could result in communications being less protected against future decryption threats than the administrator expected.
Technical details
An implementation defect in OpenSSL 3.5 and 3.6 causes the TLS 1.3 server to lose the 'tuple' structure of its key exchange group list when the 'DEFAULT' keyword is used for interpolation. This results in the server treating all supported groups as a single flat list rather than respecting security-level preferences. Consequently, the server may fail to issue a Hello Retry Request (HRR) to negotiate a more secure group (such as a hybrid post-quantum group like X25519MLKEM768) if the client initially predicted a less-preferred classical group. This is classified as an algorithm downgrade vulnerability (CWE-757). Users should upgrade to OpenSSL 3.5.6 or 3.6.2.
Affected products
- OpenSSL Foundation OpenSSL 3.5, 3.6
Timeline
- 2026-03-13: disclosed
- 2026-03-13: advisory
References
- https://github.com/openssl/openssl/commit/2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f
- https://github.com/openssl/openssl/commit/85977e013f32ceb96aa034c0e741adddc1a05e34
- https://openssl-library.org/news/secadv/20260313.txt
- http://www.openwall.com/lists/oss-security/2026/03/13/3
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html