OpenSSL up to 3.6.1 RSA KEM RSASVE Encapsulation RSA_public_encrypt uninitialized pointer

Summaryinfo

A vulnerability was found in OpenSSL up to 3.0.19/3.3.6/3.4.4/3.5.5/3.6.1. It has been rated as problematic. The impacted element is the function RSA_public_encrypt of the component RSA KEM RSASVE Encapsulation. The manipulation leads to uninitialized pointer. This vulnerability is documented as CVE-2026-31790. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in OpenSSL up to 3.0.19/3.3.6/3.4.4/3.5.5/3.6.1 and classified as problematic. This issue affects the function RSA_public_encrypt of the component RSA KEM RSASVE Encapsulation. The manipulation with an unknown input leads to a uninitialized pointer vulnerability. Using CWE to declare the problem leads to CWE-824. The product accesses or uses a pointer that has not been initialized. Impacted is confidentiality.

The weakness was released by Simo Sorce. The advisory is shared at openssl-library.org. The identification of this vulnerability is CVE-2026-31790. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/20/2026).

The vulnerability scanner Nessus provides a plugin with the ID 305682 (SUSE SLES15 Security Update : openssl-3 (SUSE-SU-2026:1213-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.0.20, 3.3.7, 3.4.5, 3.5.6 or 3.6.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (305682), EUVD (EUVD-2026-19969) and CERT Bund (WID-SEC-2026-0995). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• IBM AIX
• IBM VIOS
• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Red Hat Ansible Automation Platform
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• NetApp AFF
• SUSE openSUSE
• RESF Rocky Linux
• IBM MQ
• NetApp FAS
• Microsoft Azure Linux
• Open Source OpenSSL
• NCP Secure Enterprise VPN Server

Productinfo

Type

• Network Encryption Software

Name

• OpenSSL

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15
• 3.0.16
• 3.0.17
• 3.0.18
• 3.0.19
• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.3.5
• 3.3.6
• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.5.4
• 3.5.5
• 3.6.0
• 3.6.1

License

• open-source

Website

• Product: https://www.openssl.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion