OpenSSL have published a security advisory. Here's how it affects BoringSSL:
| CVE | Summary | Severity in OpenSSL | Impact to BoringSSL |
|---|---|---|---|
| CVE-2026-18798 | QUIC Server May Trigger Double Free When Processing INITIAL Packet | Moderate | Not affected, issue was introduced after fork |
| CVE-2026-63072 | Heap Buffer Overflow in CMS Key Unwrapping | Moderate | Not affected, issue was introduced after fork |
| CVE-2026-63076 | Invalid Pointer Dereference in CMP Server via Crafted protectionAlg | Moderate | Not affected, issue was introduced after fork |
| CVE-2026-14457 | RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate | Low | Not affected, issue was introduced after fork |
| CVE-2026-54874 | Excessive Memory Use Buffering DTLS Records for a Future Epoch | Low | Not affected, BoringSSL removed this buffering in 2015 |
| CVE-2026-63073 | Untrusted Sender DN Used as Format String in CMP Response Validation | Low | Not affected, issue was introduced after fork |
| CVE-2026-63074 | CMP Indefinite Cache Growth of ExtraCerts | Low | Not affected, issue was introduced after fork |
| CVE-2026-63075 | QUIC ACK-only Packet Retention Can Cause Memory Exhaustion | Low | Not affected, issue was introduced after fork |
| CVE-2026-75803 | AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher() | Low | Not affected, issue was introduced after fork |