CVE-2026-31790
highpriority · track · 0EPSS 0.010 · 63 %ileDEEUFRNLRUUSEPSS · scored 2026-10-22
Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSIMATIC CN 4100siemens_psirt
Update to V5.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814144/ - FixedSIMATIC CN 4100cisa_csaf_ot
Update to V5.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814144/
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (72)
Products and version ranges known to be affected.
- NetApp AFF Baseboard Management Controllerall versionscert_bundDEcpe:/h:netapp:aff:::baseboard_management_controller
- NetApp FAS Baseboard Management Controllerall versionscert_bundDEcpe:/h:netapp:fas:baseboard_management_controller
- Red Hat Ansible Automation Platform 2.6all versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:2.6
advisories (9)
Vendor and ecosystem advisories describing this.
- NCSC-2026-0147Kwetsbaarheden verholpen in Siemens-productenNL2026-05-13csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in verschillende (OT-)producten. Het gaat onder andere om producten in de Siemens RUGGEDCOM-, SCALANCE-, SIMATIC-, SIMIT-, SINAMICS-, SIPROTEC-, SENTRON- en Solid Edge-productreeksen.
- NCSC-2026-0445Kwetsbaarheden verholpen in Oracle AnalyticsNL2026-10-21csaf · ncsc_nlNL
Oracle heeft 33 kwetsbaarheden verholpen in diverse Oracle Analytics-producten, waaronder Oracle Business Intelligence Enterprise Edition en Oracle BI Publisher.
- SSA-032379SSA-032379: Multiple Vulnerabilities in SIMATIC CN 4100 Before V5.02026-05-12csaf · siemens_psirtDE
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
- WID-SEC-W-2026-0995OpenSSL: Mehrere SchwachstellenDeutsch2026-04-07csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder andere, nicht näher spezifizierte Angriffe durchzuführen.
- WID-SEC-W-2026-1198Oracle Database Server: Mehrere SchwachstellenDeutsch2026-04-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Database Server ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2026-2437Oracle Communications: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2026-2919IBM App Connect Enterprise: Mehrere SchwachstellenDeutsch2026-08-18csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
- ICSA-26-134-10Siemens SIMATIC2026-05-12icsa · cisa_csaf_otUS
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
- CERTFR-2026-AVI-1351Multiples vulnérabilités dans Oracle MySQLFrançais2026-10-21vendor · certfrFR
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (23)
External citations — patches, advisories, analysis.
- https://github.com/openssl/openssl/commit/001e01db3e996e13ffc72386fe79d03a6683b5accnnvd
- https://github.com/openssl/openssl/commit/abd8b2eec7e3f3fda60ecfb68498b246b52af482cnnvd
- https://github.com/openssl/openssl/commit/b922e24e5b23ffb9cb9e14cadff23d91e9f7e406cnnvd
- https://github.com/openssl/openssl/commit/d5f8e71cd0a54e961d0c3b174348f8308486f790cnnvd
- https://github.com/openssl/openssl/commit/eed200f58cd8645ed77e46b7e9f764e284df379ecnnvd
- https://github.com/openssl/openssl/releasesPatchcnnvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31790cnnvd
- https://openssl-library.org/news/secadv/20260407.txtcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan