Skip to content
Fencer Vulns
medium 6.5

CVE-2026-2673 json

OpenSSL TLS 1.3 server may choose unexpected key agreement group

published 2026-03-13 7 mo ago modified 2026-08-13 2 mo ago also EUVD-2026-12033 , GHSA-wj64-gh9j-xm82 , JLSEC-2026-271

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword.

Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server.

If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported.

As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction).

OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included.

The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group.

The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'.

No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary.

OpenSSL 3.6 and 3.5 are vulnerable to this issue.

OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.

OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.

Patch / fix

  • julia AppBundler 1.0.1
  • julia OpenSSL_jll 3.5.6+0
  • OpenSSL OpenSSL 3.5.6, 3.6.2
  • Siemens SIMATIC CN 4100 V5.0
  • openssl Debian 13 3.5.5-1~deb13u2
  • openssl Debian 14 3.6.2-1

debian advisories DEBIAN-CVE-2026-2673

  • openssl Ubuntu 25.10 3.5.3-1ubuntu3.3
  • openssl Ubuntu 26.10, Ubuntu 26.04 LTS 3.5.5-1ubuntu3

ubuntu advisories UBUNTU-CVE-2026-2673

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl RHEL 9 1:3.5.5-3.el9_8
  • openssl-libs RHEL 9 1:3.5.5-3.el9_8
  • openssl-perl RHEL 9 1:3.5.5-3.el9_8
  • openssl RHEL 10.2 1:3.5.5-2.el10_2
  • openssl-libs RHEL 10.2 1:3.5.5-2.el10_2
  • openssl-perl RHEL 10.2 1:3.5.5-2.el10_2
  • openssl hummingbird 1 3.5.6-0.1.hum1
  • openssl-libs hummingbird 1 3.5.6-0.1.hum1

red hat advisories RHSA-2026:22312RHSA-2026:19066RHSA-2026:7261

  • openssl-3 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.5.0-160000.8.1
  • openssl-3 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.5.0-160000.7.1

suse advisories SUSE-SU-2026:22251-1SUSE-SU-2026:22315-1SUSE-SU-2026:21107-1SUSE-SU-2026:21186-1

  • openssl-3 openSUSE Leap 16.0 3.5.0-160000.8.1
  • openssl-3 openSUSE Leap 16.0 3.5.0-160000.7.1
  • openssl-3 openSUSE Tumbleweed 3.5.3-4.1

opensuse advisories openSUSE-SU-2026:21005-1openSUSE-SU-2026:20525-1openSUSE-SU-2026:10533-1

  • openssl AlmaLinux 9 1:3.5.5-3.el9_8
  • openssl-libs AlmaLinux 9 1:3.5.5-3.el9_8
  • openssl-perl AlmaLinux 9 1:3.5.5-3.el9_8
  • openssl AlmaLinux 10 1:3.5.5-2.el10_2.alma.1
  • openssl-libs AlmaLinux 10 1:3.5.5-2.el10_2.alma.1
  • openssl-perl AlmaLinux 10 1:3.5.5-2.el10_2.alma.1

almalinux advisories ALSA-2026:22312ALSA-2026:19066

  • openssl Alpine 3.24, Alpine 3.23, Alpine 3.22 3.5.6-r0

alpine advisories ALPINE-CVE-2026-2673

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-2673 updated cvss 6.5

openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group

  • Red Hat JBoss Web Server 5 jbcs-httpd24-openssl
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/cert-manager-operator-bundle 1791970484, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
    fixed: vendor fix RHSA-2026:82888
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/cert-manager-operator-rhel9 1789029076, cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/cert-manager-istio-csr-rhel9 1791459759, cert-manager/cert-manager-operator-bundle 1791966259, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
    fixed: vendor fix RHSA-2026:82354
  • Red Hat Enterprise Linux AppStream (v. 9) openssl-perl 3.5.5-3.el9_8
    fixed: vendor fix RHSA-2026:22312
  • Red Hat Enterprise Linux AppStream (v. 10) openssl-perl 3.5.5-2.el10_2
    fixed: vendor fix RHSA-2026:19066
  • Red Hat Enterprise Linux BaseOS (v. 9) openssl 3.5.5-3.el9_8, openssl-libs 3.5.5-3.el9_8
    fixed: vendor fix RHSA-2026:22312
  • Red Hat Enterprise Linux BaseOS (v. 10) openssl 3.5.5-2.el10_2, openssl-libs 3.5.5-2.el10_2
    fixed: vendor fix RHSA-2026:19066
  • Red Hat Hardened Images openssl 3.5.6-0.1.hum1, openssl-libs 3.5.6-0.1.hum1, openssl-perl 3.5.6-0.1.hum1, openssl-config-fips 3.5.6-0.1.hum1, openssl-devel-engine 3.5.6-0.1.hum1
    fixed: vendor fix RHSA-2026:7261
show 6 more
  • Red Hat JBoss Core Services 2.4.62.SP4
    fixed: vendor fix RHSA-2026:27201
  • Red Hat JBoss Web Server 6.2.4
    fixed: vendor fix RHSA-2026:43402
  • Red Hat JBoss Web Server 7.0.0
    fixed: vendor fix RHSA-2026:39189
  • Red Hat Enterprise Linux 6 openssl, openssl098e, openssl-perl Red Hat Enterprise Linux 7 openssl, openssl098e, openssl-libs, openssl-perl Red Hat Enterprise Linux 8 openssl, openssl-libs, openssl-perl, mingw-openssl, mingw32-openssl, mingw64-openssl, +1 more
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 9 compat-openssl11, openssl-fips-provider, openssl-fips-provider-so
    not affected: component not present
  • Red Hat Enterprise Linux 10 openssl-fips-provider
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
OSV 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
julia AppBundler
>=1.0.0, <1.0.1
1.0.1
julia OpenSSL_jll
>=3.5.0+0, <3.5.6+0
3.5.6+0
julia Openresty_jll
>=1.29.203+0
 no fix listed

Affected products

  • OpenSSL OpenSSL
  • Siemens SIMATIC CN 4100

Classification

Weakness
  • CWE-757 Selection of Less-Secure Algorithm During Negotiation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.