OpenSSL up to 3.0.19/3.3.6/3.4.4/3.5.5/3.6.1 Hexadecimal Conversion heap-based overflow

Summaryinfo

A vulnerability classified as critical has been found in OpenSSL up to 3.0.19/3.3.6/3.4.4/3.5.5/3.6.1. This affects an unknown part of the component Hexadecimal Conversion Handler. The manipulation leads to heap-based overflow. This vulnerability is uniquely identified as CVE-2026-31789. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in OpenSSL up to 3.0.19/3.3.6/3.4.4/3.5.5/3.6.1. This issue affects some unknown processing of the component Hexadecimal Conversion Handler. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability.

It is possible to read the advisory at openssl-library.org. The identification of this vulnerability is CVE-2026-31789. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 04/09/2026).

The vulnerability scanner Nessus provides a plugin with the ID 305682 (SUSE SLES15 Security Update : openssl-3 (SUSE-SU-2026:1213-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.0.20, 3.3.7, 3.4.5, 3.5.6 or 3.6.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (305682) and EUVD (EUVD-2026-19968). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Network Encryption Software

Name

• OpenSSL

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15
• 3.0.16
• 3.0.17
• 3.0.18
• 3.0.19
• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.3.5
• 3.3.6
• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.5.4
• 3.5.5
• 3.6.0
• 3.6.1

License

• open-source

Website

• Product: https://www.openssl.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion