OpenSSL Security Advisory
48 views
Skip to first unread message
Tomas Mraz
Mar 13, 2026, 9:23:30 AM (11 days ago) Mar 13
to openssl-project, openssl-users
OpenSSL Security Advisory [13th March 2026]
===========================================
OpenSSL TLS 1.3 server may choose unexpected key agreement group (CVE-2026-2673)
================================================================================
Severity: Low
Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected
preferred key exchange group when its key exchange group configuration includes
the default by using the "DEFAULT" keyword.
Impact summary: A less preferred key exchange may be used even when a more
preferred group is supported by both client and server, if the group
was not included among the client's initial predicated keyshares.
This will sometimes be the case with the new hybrid post-quantum groups,
if the client chooses to defer their use until specifically requested by
the server.
If an OpenSSL TLS 1.3 server's configuration uses the "DEFAULT" keyword to
interpolate the built-in default group list into its own configuration, perhaps
adding or removing specific elements, then an implementation defect causes the
"DEFAULT" list to lose its "tuple" structure, and all server-supported groups
were treated as a single sufficiently secure "tuple", with the server not
sending a Hello Retry Request (HRR) even when a group in a more preferred tuple
was mutually supported.
As a result, the client and server might fail to negotiate a mutually supported
post-quantum key agreement group, such as "X25519MLKEM768", if the client's
configuration results in only "classical" groups (such as "X25519" being the
only ones in the client's initial keyshare prediction).
OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS
1.3 key agreement group on TLS servers. The old syntax had a single "flat"
list of groups, and treated all the supported groups as sufficiently secure.
If any of the keyshares predicted by the client were supported by the server
the most preferred among these was selected, even if other groups supported by
the client, but not included in the list of predicted keyshares would have been
more preferred, if included.
The new syntax partitions the groups into distinct "tuples" of roughly
equivalent security. Within each tuple the most preferred group included among
the client's predicted keyshares is chosen, but if the client supports a group
from a more preferred tuple, but did not predict any corresponding keyshares,
the server will ask the client to retry the ClientHello (by issuing a Hello
Retry Request or HRR) with the most preferred mutually supported group.
The above works as expected when the server's configuration uses the built-in
default group list, or explicitly defines its own list by directly defining the
various desired groups and group "tuples".
No OpenSSL FIPS modules are affected by this issue, the code in question lies
outside the FIPS boundary.
OpenSSL 3.6 and 3.5 are vulnerable to this issue.
OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.
OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.
Due to the low severity of this issue we are not issuing new releases of
OpenSSL at this time. The fix will be included in the next release of 3.6
and 3.5 branches, once it becomes available. The fix is also available in commit
2157c9d8 (for 3.6) and commit 85977e01 (for 3.5) in the OpenSSL git repository.
This issue was internally reported on the 16th of February 2026 by Viktor
Dukhovni. The fix was developed by Viktor Dukhovni.
General Advisory Notes
======================
URL for this Security Advisory:
https://openssl-library.org/news/secadv/20260313.txt
Note: the online version of the advisory may be updated with additional details
over time.
For details of OpenSSL severity classifications please see:
https://openssl-library.org/policies/general/security-policy/
===========================================
OpenSSL TLS 1.3 server may choose unexpected key agreement group (CVE-2026-2673)
================================================================================
Severity: Low
Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected
preferred key exchange group when its key exchange group configuration includes
the default by using the "DEFAULT" keyword.
Impact summary: A less preferred key exchange may be used even when a more
preferred group is supported by both client and server, if the group
was not included among the client's initial predicated keyshares.
This will sometimes be the case with the new hybrid post-quantum groups,
if the client chooses to defer their use until specifically requested by
the server.
If an OpenSSL TLS 1.3 server's configuration uses the "DEFAULT" keyword to
interpolate the built-in default group list into its own configuration, perhaps
adding or removing specific elements, then an implementation defect causes the
"DEFAULT" list to lose its "tuple" structure, and all server-supported groups
were treated as a single sufficiently secure "tuple", with the server not
sending a Hello Retry Request (HRR) even when a group in a more preferred tuple
was mutually supported.
As a result, the client and server might fail to negotiate a mutually supported
post-quantum key agreement group, such as "X25519MLKEM768", if the client's
configuration results in only "classical" groups (such as "X25519" being the
only ones in the client's initial keyshare prediction).
OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS
1.3 key agreement group on TLS servers. The old syntax had a single "flat"
list of groups, and treated all the supported groups as sufficiently secure.
If any of the keyshares predicted by the client were supported by the server
the most preferred among these was selected, even if other groups supported by
the client, but not included in the list of predicted keyshares would have been
more preferred, if included.
The new syntax partitions the groups into distinct "tuples" of roughly
equivalent security. Within each tuple the most preferred group included among
the client's predicted keyshares is chosen, but if the client supports a group
from a more preferred tuple, but did not predict any corresponding keyshares,
the server will ask the client to retry the ClientHello (by issuing a Hello
Retry Request or HRR) with the most preferred mutually supported group.
The above works as expected when the server's configuration uses the built-in
default group list, or explicitly defines its own list by directly defining the
various desired groups and group "tuples".
No OpenSSL FIPS modules are affected by this issue, the code in question lies
outside the FIPS boundary.
OpenSSL 3.6 and 3.5 are vulnerable to this issue.
OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.
OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.
Due to the low severity of this issue we are not issuing new releases of
OpenSSL at this time. The fix will be included in the next release of 3.6
and 3.5 branches, once it becomes available. The fix is also available in commit
2157c9d8 (for 3.6) and commit 85977e01 (for 3.5) in the OpenSSL git repository.
This issue was internally reported on the 16th of February 2026 by Viktor
Dukhovni. The fix was developed by Viktor Dukhovni.
General Advisory Notes
======================
URL for this Security Advisory:
https://openssl-library.org/news/secadv/20260313.txt
Note: the online version of the advisory may be updated with additional details
over time.
For details of OpenSSL severity classifications please see:
https://openssl-library.org/policies/general/security-policy/
Dimitri Ledkov
Mar 13, 2026, 10:26:24 AM (11 days ago) Mar 13
to openssl-project
Hi,
On Fri, Mar 13, 2026 at 1:23 PM 'Tomas Mraz' via openssl-project
<openssl...@openssl.org> wrote:
>
> No OpenSSL FIPS modules are affected by this issue, the code in question lies
> outside the FIPS boundary.
>
> OpenSSL 3.6 and 3.5 are vulnerable to this issue.
>
> OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.
> OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.
>
> OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.
>
> Due to the low severity of this issue we are not issuing new releases of
> OpenSSL at this time. The fix will be included in the next release of 3.6
> and 3.5 branches, once it becomes available. The fix is also available in commit
> 2157c9d8 (for 3.6) and commit 85977e01 (for 3.5) in the OpenSSL git repository.
>
Please cherrypick this fix on top of 3.6.1 and 3.5.5 to create 3.6.1.1
and 3.5.5.1 with fix for CVE-2026-2673 alone.
And push these two tags without any other release processes.
Please update the security advisory to state that CVE is fixed in
3.6.1.1 and 3.5.5.1.
Otherwise all scanners will start telling people they are vulnerable
and must upgrade to the non-existent 3.5.6 and 3.6.2 in about 24h over
the weekend.
Please never announce CVEs on a Friday.
Doing such cherry-pick and tag, and merging that into 3.5/3.6 update
branch would have been no additional work for you; yet it would have
saved countless hours for all distributors doing git cherry-pick by
hand; instead of letting automation to automatially upgrade to the new
microtag.
This has been requested before at
https://openssl-communities.org/d/NjVMRUHC/ensure-security-bugs-always-have-a-tag-attached
I.e. branch last stable tag; apply CVE fix; tag a micro-tag; merge
into stable branch if a full point release is not yet due.
Regards,
Dimitri.
On Fri, Mar 13, 2026 at 1:23 PM 'Tomas Mraz' via openssl-project
<openssl...@openssl.org> wrote:
>
> No OpenSSL FIPS modules are affected by this issue, the code in question lies
> outside the FIPS boundary.
>
> OpenSSL 3.6 and 3.5 are vulnerable to this issue.
>
> OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.
> OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.
>
> OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.
>
> Due to the low severity of this issue we are not issuing new releases of
> OpenSSL at this time. The fix will be included in the next release of 3.6
> and 3.5 branches, once it becomes available. The fix is also available in commit
> 2157c9d8 (for 3.6) and commit 85977e01 (for 3.5) in the OpenSSL git repository.
>
and 3.5.5.1 with fix for CVE-2026-2673 alone.
And push these two tags without any other release processes.
Please update the security advisory to state that CVE is fixed in
3.6.1.1 and 3.5.5.1.
Otherwise all scanners will start telling people they are vulnerable
and must upgrade to the non-existent 3.5.6 and 3.6.2 in about 24h over
the weekend.
Please never announce CVEs on a Friday.
Doing such cherry-pick and tag, and merging that into 3.5/3.6 update
branch would have been no additional work for you; yet it would have
saved countless hours for all distributors doing git cherry-pick by
hand; instead of letting automation to automatially upgrade to the new
microtag.
This has been requested before at
https://openssl-communities.org/d/NjVMRUHC/ensure-security-bugs-always-have-a-tag-attached
I.e. branch last stable tag; apply CVE fix; tag a micro-tag; merge
into stable branch if a full point release is not yet due.
Regards,
Dimitri.
Tomas Mraz
Mar 13, 2026, 10:42:20 AM (11 days ago) Mar 13
to Dimitri Ledkov, openssl-project
Hello Dimitri,
I am sorry but no, we are not going to do this. It would be seriously
confusing to our users. This is something we've never done before and
we did not agree on changing our policy in that regard yet.
Besides, the advisory is of Low severity, in practice mostly
informational type.
Kind regards,
Tomas Mraz, CTO, OpenSSL Foundation
On Fri, 2026-03-13 at 14:25 +0000, 'Dimitri Ledkov' via openssl-project
wrote:
--
Tomáš Mráz, Chief Technology Officer, OpenSSL Foundation
We need your support! Help us protect digital privacy… everywhere.
https://openssl.foundation/donate/ways-to-give
I am sorry but no, we are not going to do this. It would be seriously
confusing to our users. This is something we've never done before and
we did not agree on changing our policy in that regard yet.
Besides, the advisory is of Low severity, in practice mostly
informational type.
Kind regards,
Tomas Mraz, CTO, OpenSSL Foundation
On Fri, 2026-03-13 at 14:25 +0000, 'Dimitri Ledkov' via openssl-project
wrote:
Tomáš Mráz, Chief Technology Officer, OpenSSL Foundation
We need your support! Help us protect digital privacy… everywhere.
https://openssl.foundation/donate/ways-to-give
Dimitri Ledkov
Mar 13, 2026, 11:16:49 AM (11 days ago) Mar 13
to Tomas Mraz, openssl-project
Hi,
On Fri, Mar 13, 2026 at 2:42 PM Tomas Mraz <to...@openssl.foundation> wrote:
>
> Hello Dimitri,
>
> I am sorry but no, we are not going to do this. It would be seriously
> confusing to our users. This is something we've never done before and
> we did not agree on changing our policy in that regard yet.
>
> Besides, the advisory is of Low severity, in practice mostly
> informational type.
But this vulnerability affects every distributor of OpenSSL that
currently build from tarball or tag. For example, all binary
distributions of nodejs; python; py cryptography wheels; etc.
Lack of version will cause this to be flagged by scanners triggering
thousands of engineering hours to figure out why there is not a fix,
and to silence it.
And every distributor who cherry-picks this will have to create manual
advisories for it, often by hand.
All over releases of key components or libraries/packages for Go,
Java, Javascript, Python - all tag releases for security fixes when
there is one.
Heck, even linux kernel publishes stable tags for all security
releases, with matching rich commit level and source file level
metadata.
Or hold it back until next scheduled release - for example Java does
quarterly batches of all fixes.
Thus in general it is easier to track & upgrade CVE fixes for all of
Java, than it is for OpenSSL.
Please reconsider your policies, as they are incompatible with how all
other software operates and releases automation for CVE detection and
remediation - at any severity level.
On Fri, Mar 13, 2026 at 2:42 PM Tomas Mraz <to...@openssl.foundation> wrote:
>
> Hello Dimitri,
>
> I am sorry but no, we are not going to do this. It would be seriously
> confusing to our users. This is something we've never done before and
> we did not agree on changing our policy in that regard yet.
>
> Besides, the advisory is of Low severity, in practice mostly
> informational type.
currently build from tarball or tag. For example, all binary
distributions of nodejs; python; py cryptography wheels; etc.
Lack of version will cause this to be flagged by scanners triggering
thousands of engineering hours to figure out why there is not a fix,
and to silence it.
And every distributor who cherry-picks this will have to create manual
advisories for it, often by hand.
All over releases of key components or libraries/packages for Go,
Java, Javascript, Python - all tag releases for security fixes when
there is one.
Heck, even linux kernel publishes stable tags for all security
releases, with matching rich commit level and source file level
metadata.
Or hold it back until next scheduled release - for example Java does
quarterly batches of all fixes.
Thus in general it is easier to track & upgrade CVE fixes for all of
Java, than it is for OpenSSL.
Please reconsider your policies, as they are incompatible with how all
other software operates and releases automation for CVE detection and
remediation - at any severity level.
Shane Lontis
Mar 16, 2026, 7:40:48 PM (8 days ago) Mar 16
to Tomas Mraz, Dimitri Ledkov, openssl-project
Confidential - Oracle Restricted \Including External Recipients
If this problem is related to OpenSSL publicly releasing information related to low severity CVE's before they appear in a release, the solution is to change the policy so that they are not released early.
From: 'Dimitri Ledkov' via openssl-project <openssl...@openssl.org>
Sent: Saturday, March 14, 2026 2:16 AM
To: Tomas Mraz <to...@openssl.foundation>
Cc: openssl-project <openssl...@openssl.org>
Subject: [External] : Re: OpenSSL Security Advisory
Sent: Saturday, March 14, 2026 2:16 AM
To: Tomas Mraz <to...@openssl.foundation>
Cc: openssl-project <openssl...@openssl.org>
Subject: [External] : Re: OpenSSL Security Advisory
> >
> > I.e. branch last stable tag; apply CVE fix; tag a micro-tag; merge
> > into stable branch if a full point release is not yet due.
> >
> > Regards,
> >
> > Dimitri.
>
> --
> Tomáš Mráz, Chief Technology Officer, OpenSSL Foundation
> We need your support! Help us protect digital privacy… everywhere.
>
https://urldefense.com/v3/__https://openssl.foundation/donate/ways-to-give__;!!ACWV5N9M2RV99hQ!KtQ2US1IOSNF1FW7ZvBzaZgKqNwHmxoKygz76I8GU5mLINHPfcDBvfPVrbDFL0kHCeVbC_mgUqu4lXEIRztajRM6KUJ1wA$
--
You received this message because you are subscribed to the Google Groups "openssl-project" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-proje...@openssl.org.
To view this discussion visit https://urldefense.com/v3/__https://groups.google.com/a/openssl.org/d/msgid/openssl-project/CA*2BV*3D*2BpvxcCHkQL-h5e2q-hxCGDXPARDk8ETTgdfcMQ51asvWsA*40mail.gmail.com__;JSUlJQ!!ACWV5N9M2RV99hQ!KtQ2US1IOSNF1FW7ZvBzaZgKqNwHmxoKygz76I8GU5mLINHPfcDBvfPVrbDFL0kHCeVbC_mgUqu4lXEIRztajRPtKdtqlA$ .
--
You received this message because you are subscribed to the Google Groups "openssl-project" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-proje...@openssl.org.
To view this discussion visit https://urldefense.com/v3/__https://groups.google.com/a/openssl.org/d/msgid/openssl-project/CA*2BV*3D*2BpvxcCHkQL-h5e2q-hxCGDXPARDk8ETTgdfcMQ51asvWsA*40mail.gmail.com__;JSUlJQ!!ACWV5N9M2RV99hQ!KtQ2US1IOSNF1FW7ZvBzaZgKqNwHmxoKygz76I8GU5mLINHPfcDBvfPVrbDFL0kHCeVbC_mgUqu4lXEIRztajRPtKdtqlA$ .
Confidential - Oracle Restricted \Including External Recipients
Dimitri Ledkov
Mar 18, 2026, 3:48:59 PM (6 days ago) Mar 18
to Tomas Mraz, openssl-project, openssl-users
The NVD has updated the CVE https://nvd.nist.gov/vuln/detail/CVE-2026-2673
The assigned score is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
which is classed as High by multiple security scanners.
Due to lack of upstream tags and tarballs, I have prepared backports
of the fix onto stable releases 3.5.5+1 and 3.6.1+1 and published that
at: https://github.com/openssl-stable/openssl-stable/releases
Any users can reuse the git cherry-picks, rebased and conflicts
resolved, or download immutable releases from there.
I again call for OpenSSL upstream to reconsider and tag releases for
any CVE. It is always best to branch last point release, commit the
fix, tag it, and merge into the updates branch. This way, tagged
releases require no additional work. Git describe can then correctly
identify the builds before and after the fix on the updates branch as
those with or without the fix.
The OpenSSL assessment and classification of CVEs may not align with
classification determined by the regulators. Hence all CVE patches
should follow the same process once they are made public.
Regards,
Dimitri.
The assigned score is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
which is classed as High by multiple security scanners.
Due to lack of upstream tags and tarballs, I have prepared backports
of the fix onto stable releases 3.5.5+1 and 3.6.1+1 and published that
at: https://github.com/openssl-stable/openssl-stable/releases
Any users can reuse the git cherry-picks, rebased and conflicts
resolved, or download immutable releases from there.
I again call for OpenSSL upstream to reconsider and tag releases for
any CVE. It is always best to branch last point release, commit the
fix, tag it, and merge into the updates branch. This way, tagged
releases require no additional work. Git describe can then correctly
identify the builds before and after the fix on the updates branch as
those with or without the fix.
The OpenSSL assessment and classification of CVEs may not align with
classification determined by the regulators. Hence all CVE patches
should follow the same process once they are made public.
Regards,
Dimitri.
> --
> You received this message because you are subscribed to the Google Groups "openssl-project" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to openssl-proje...@openssl.org.
> To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-project/10107223b33073994e235de61f20bde963d8fe0b.camel%40openssl.foundation.
> You received this message because you are subscribed to the Google Groups "openssl-project" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to openssl-proje...@openssl.org.
Tomas Mraz
Mar 19, 2026, 4:30:20 AM (6 days ago) Mar 19
to Dimitri Ledkov, openssl-project, openssl-users
The NVD classification for this basically non-issue is just hilarious.
I have no further comments.
Tomas Mraz, CTO, OpenSSL Foundation
I have no further comments.
Tomas Mraz, CTO, OpenSSL Foundation
--
Tomáš Mráz, Chief Technology Officer, OpenSSL Foundation
We need your support! Help us protect digital privacy… everywhere.
https://openssl.foundation/donate/ways-to-give
Tomáš Mráz, Chief Technology Officer, OpenSSL Foundation
We need your support! Help us protect digital privacy… everywhere.
Reply all
Reply to author
Forward
0 new messages