OpenSSL Advisory: August 25th, 2026 (BoringSSL Not Affected) BoringSSL counterpart to https://openssl-library.org/news/secadv/20260825.txt Change-Id: I1548db57586757cb8d2bc3cc618028596dfd3ea1 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101707 Auto-Submit: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Lily Chen <chlily@google.com> Commit-Queue: Lily Chen <chlily@google.com>
diff --git a/docs/advisories/2026-08-25.md b/docs/advisories/2026-08-25.md new file mode 100644 index 0000000..41fb490 --- /dev/null +++ b/docs/advisories/2026-08-25.md
@@ -0,0 +1,17 @@ +# OpenSSL Advisory: August 25th, 2026 (BoringSSL Not Affected) + +OpenSSL have published a [security advisory](https://openssl-library.org/news/secadv/20260825.txt). Here's how it affects BoringSSL: + +CVE | Summary | [Severity] in OpenSSL | Impact to BoringSSL +----|---------|-----------------------|--------------------- +CVE-2026-18798 | QUIC Server May Trigger Double Free When Processing INITIAL Packet | Moderate | Not affected, issue was introduced after fork +CVE-2026-63072 | Heap Buffer Overflow in CMS Key Unwrapping | Moderate | Not affected, issue was introduced after fork +CVE-2026-63076 | Invalid Pointer Dereference in CMP Server via Crafted protectionAlg | Moderate | Not affected, issue was introduced after fork +CVE-2026-14457 | RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate | Low | Not affected, issue was introduced after fork +CVE-2026-54874 | Excessive Memory Use Buffering DTLS Records for a Future Epoch | Low | Not affected, BoringSSL removed this buffering in [2015](https://boringssl-review.googlesource.com/4238) +CVE-2026-63073 | Untrusted Sender DN Used as Format String in CMP Response Validation | Low | Not affected, issue was introduced after fork +CVE-2026-63074 | CMP Indefinite Cache Growth of ExtraCerts | Low | Not affected, issue was introduced after fork +CVE-2026-63075 | QUIC ACK-only Packet Retention Can Cause Memory Exhaustion | Low | Not affected, issue was introduced after fork +CVE-2026-75803 | AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher() | Low | Not affected, issue was introduced after fork + +[Severity]: https://openssl-library.org/policies/general/security-policy/index.html#issue-severity