CVE-2026-72897: OpenSSL out-of-bounds read/write in SSL_set_SSL_CTX

CVE-2026-72897 · Severity: info · Published 2026-09-29

OpenSSL, a cryptographic library used to secure internet communications, contains a flaw in how it handles TLS connections when switching to a different security context mid-handshake. An attacker connecting to a vulnerable server could trigger a small out-of-bounds memory read or write, potentially causing the server to crash and denying service to legitimate users. This only affects servers that use specific advanced configuration options and is not a default vulnerability.

Technologies: OpenSSL. Vendors: OpenSSL.

Quick answers

Is CVE-2026-72897 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-72897 being exploited in the wild.
How severe is CVE-2026-72897?
Informational severity, published 29 September 2026.
Which products and versions are affected?
OpenSSL OpenSSL.
Is there a fix for CVE-2026-72897?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-72897 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-72897?
Check whether you run OpenSSL. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A TLS server using SSL_set_SSL_CTX() to switch SSL contexts during the handshake (common in SNI callbacks for multi-host setups) fails to update its internal array size when the new context supports more provider signature algorithms. When a peer offers signature algorithms beyond the stale array bounds, the code reads and conditionally writes to out-of-bounds heap memory, potentially corrupting heap metadata. The vulnerability requires TLS 1.3, different provider signature algorithm counts between contexts, and misconfigured certificate slots that would already prevent legitimate negotiation.

Affected products

  • OpenSSL OpenSSL

Timeline

  • 2026-09-29: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.