SKYLINE Blog

Security advisory Debian

Debian OpenSSL updates January-August 2026: DSA-6113-1, DSA-6201-1, DSA-6335-1 and DSA-6465-1

Four Debian OpenSSL advisories between January and August 2026 fixed 33 CVEs, two rated High by OpenSSL. What each fixed and how to confirm you are current.

Published
Reading time
5 min read

Security advisory Vulnerability

Severity: High Status: Patched
CVE IDs
Status
Fixed versions are available for Debian 13 (trixie) and Debian 12 (bookworm).
Affected
  • openssl in Debian 13 (trixie) before 3.5.4-1~deb13u2
  • openssl in Debian 12 (bookworm) before 3.0.18-1~deb12u2
  • openssl in Debian 13 (trixie) before 3.5.5-1~deb13u2
  • openssl in Debian 12 (bookworm) before 3.0.19-1~deb12u2
  • openssl in Debian 13 (trixie) before 3.5.6-1~deb13u2
  • openssl in Debian 12 (bookworm) before 3.0.20-1~deb12u2
  • openssl in Debian 13 (trixie) before 3.5.7-1~deb13u2
  • openssl in Debian 12 (bookworm) before 3.0.22-1~deb12u1
Published
Updated

What you should do

  • Confirm every Debian 12 and 13 machine and container image runs the newest OpenSSL build for its release.
  • Pay particular attention to systems that process S/MIME, CMS or PKCS#7 data from outside, such as mail gateways and document-signing services.
  • Restart TLS-using services or reboot after the update.
  • Enable automatic security updates so future OpenSSL fixes do not wait for a manual check.
Timeline
  1. Debian published DSA-6113-1 for openssl.
  2. Debian published DSA-6201-1 for openssl.
  3. Debian published DSA-6335-1 for openssl.
  4. Debian published DSA-6465-1 for openssl.
  5. The Debian LTS team published DLA-4795-1 for openssl.
  6. Skyline published this summary.

Between January and August 2026 Debian published four OpenSSL security advisories, each following an upstream OpenSSL advisory. Together they fix 33 CVEs; OpenSSL rated two of them High because they could, in the worst case, allow code execution when an application parses hostile signed or encrypted messages. Debian 12 (bookworm) received the August fixes later, through the LTS advisory DLA-4795-1, because regular support for bookworm ended in July 2026 and the Debian LTS team took over its security updates.

At a glance

AdvisoryDateCVEsHighest OpenSSL ratingDebian 13 (trixie)Debian 12 (bookworm)
DSA-6113-127 Jan 20268High (CVE-2025-15467)3.5.4-1~deb13u23.0.18-1~deb12u2
DSA-6201-17 Apr 20266Moderate (CVE-2026-31790)3.5.5-1~deb13u23.0.19-1~deb12u2
DSA-6335-19 Jun 20269High (CVE-2026-45447)3.5.6-1~deb13u23.0.20-1~deb12u2
DSA-6465-125 Aug 202610Moderate (CVE-2026-18798, CVE-2026-63072, CVE-2026-63076)3.5.7-1~deb13u2see DLA-4795-1
DLA-4795-125 Sep 20266Moderate (CVE-2026-63072, CVE-2026-63076)not applicable3.0.22-1~deb12u1

Each update is cumulative: installing the newest OpenSSL package for your release includes every fix above. Newer updates have since been released (DSA-6531-1 on 30 September for trixie and DLA-4859-1 on 26 October for bookworm), so the version to aim for today is 3.5.7-1~deb13u3 or 3.0.22-1~deb12u2.

What was fixed

The two High-rated issues

  • CVE-2025-15467 (DSA-6113-1). A stack buffer overflow when parsing CMS AuthEnvelopedData or EnvelopedData with crafted AEAD parameters. OpenSSL says it may lead to a crash or potentially remote code execution, and that no valid key is needed because the overflow happens before authentication. Applications that parse untrusted CMS or S/MIME content are exposed. CISA's assessment on cve.org records a public proof of concept; the CVE is not in CISA's Known Exploited Vulnerabilities catalog.
  • CVE-2026-45447 (DSA-6335-1). A use-after-free during PKCS#7 or S/MIME signature verification in PKCS7_verify(), which OpenSSL says may cause crashes, heap corruption or potentially remote code execution.

Moderate-rated issues

  • CVE-2026-31790 (April): incorrect failure handling in RSA KEM encapsulation could leak uninitialised memory.
  • CVE-2026-34182 and CVE-2026-45445 (June): CMS AuthEnvelopedData input checks, and AES-OCB ignoring the caller's IV on the EVP_Cipher() path, which leads to nonce reuse.
  • CVE-2026-18798, CVE-2026-63072, CVE-2026-63076 (August): a double free in the QUIC server (OpenSSL 3.5 and later, so trixie only), an 8-byte heap overflow during CMS key unwrapping, and a crash in CMP servers and clients.

The remaining CVEs are rated Low and are mostly crashes from malformed certificates, CRLs, PKCS#12 files or CMS data, plus memory growth in DTLS and QUIC handling. Debian's own summary for the first three advisories is "denial of service, information leaks, or potentially remote code execution"; for DSA-6465-1 it is denial of service.

Are you affected?

Check the library and command-line packages:

dpkg-query -W -f='${Package} ${Version}\n' openssl 'libssl3*'
apt policy libssl3t64   # Debian 13
apt policy libssl3      # Debian 12

If the Installed version is lower than the newest one listed above for your release, you are missing fixes. Debian 11 (bullseye) reached the end of LTS on 31 August 2026 and no longer receives Debian updates; upgrade it.

How to update

sudo apt update
sudo apt upgrade

Or limit the change to OpenSSL:

sudo apt install --only-upgrade openssl libssl3t64   # Debian 13
sudo apt install --only-upgrade openssl libssl3      # Debian 12

Bookworm users get these fixes from the normal bookworm-security source; LTS uses the same repository. Ubuntu packages differ, so use Ubuntu Security Notices for Ubuntu servers.

Restart or reboot?

A library update does not touch processes that are already running. Restart the services that use TLS (web, mail, VPN, database and application servers), or reboot. sudo needrestart -r l from the needrestart package lists processes still using the old library.

Sources

Topics

SKYLINE Engineering

@skyline

The engineering team at SKYLINE Industrial Solutions. We publish field-tested guides drawn from real KSA and GCC deployments.

See author profile
More in Debian

Related: Skyline Nexus ERP guides

Nexus knowledge base →
Skyline Nexus ERP

Gulf & Middle East tax and e-invoicing guides

VAT, ZATCA e-invoicing and corporate tax explained for Saudi Arabia, the UAE and the wider GCC.

 Skyline Nexus ERP

Skyline Nexus ERP — cloud accounting & ZATCA e-invoicing

Our cloud ERP: accounting, invoicing, inventory and POS in one place. First month free.
SKYLINE engineering services

Need this implemented for you?

Reading is free — building it right takes a team. SKYLINE engineers ship Debian for Aramco vendors, banks, hospitals and government agencies across Saudi Arabia. Talk to us before you start.

Server Infrastructure Dell, HPE, Huawei, VMware, Hyper-V, HCI IT AMC Annual maintenance, 24/7 SLA, Bronze→Platinum
Talk to a SKYLINE engineer Call +966 50 993 9334
Aramco Approved Contractor ISO 9001 · ISO 27001 SAMA CSF aligned NCA ECC ready 247+ KSA clients

Comments

0 total · 0 threads
Be the first to leave a comment.