CVE-2026-31789 Openssl CVE debrief

Who should care

Teams running OpenSSL on 32-bit systems, especially applications or services that parse, print, or log untrusted X.509 certificates. Security and operations teams should also care if they consume certificates with SKID, AKID, or similar extensions and rely on OpenSSL for formatting or logging certificate data.

Technical summary

The vulnerable code path converts an excessively large OCTET STRING to a hex string. The buffer size is calculated as input length multiplied by 3. On 32-bit platforms, that multiplication can overflow, causing a smaller-than-needed allocation and a subsequent heap buffer overflow when the hex output is written. The supplied advisory states that the issue affects OpenSSL versions 3.0.0 through before 3.0.20, 3.3.0 through before 3.3.7, 3.4.0 through before 3.4.5, 3.5.0 through before 3.5.6, and 3.6.0 through before 3.6.2. The affected code is outside the OpenSSL FIPS module boundary, and the FIPS modules in 3.0, 3.3, 3.4, 3.5, and 3.6 are stated to be not affected.

Defensive priority

Medium for most environments, higher for 32-bit deployments that process or log untrusted certificates. The practical exploit conditions are constrained, but the impact can be severe if reachable.

Recommended defensive actions

• Upgrade OpenSSL to a fixed release: 3.0.20, 3.3.7, 3.4.5, 3.5.6, or 3.6.2, depending on your branch.
• Identify any 32-bit OpenSSL deployments, since the advisory limits the issue to 32-bit platforms.
• Review services that print, log, or otherwise format untrusted X.509 certificates and reduce or sanitize certificate logging where possible.
• Validate whether your use of OpenSSL relies on certificate extensions such as Subject Key Identifier (SKID) or Authority Key Identifier (AKID) in logging or diagnostic paths.
• Confirm whether your deployment depends on the OpenSSL FIPS module; the advisory states the affected code is outside the FIPS module boundary and the FIPS modules are not affected.
• Track the vendor advisory and NVD entry for any further clarification or backported fixes.

Evidence notes

This debrief is based only on the provided NVD record and the linked OpenSSL vendor advisory/patch references. The key claims used here are: 32-bit-only impact, heap buffer overflow during OCTET STRING to hex conversion, potential relevance to certificate logging/printing, the affected OpenSSL version ranges, and the statement that the FIPS modules are not affected. Severity context reflects both the NVD CVSS vector and the vendor’s Low-severity assessment.

Official resources