CVE-2026-28387: 
OpenSSL vulnerability analysis and mitigation

CVE-2026-28387 is a use-after-free and/or double-free vulnerability in OpenSSL's DANE TLSA-based server authentication logic, affecting the dane_match_cert() function in crypto/x509/x509_vfy.c. It was disclosed on April 7, 2026, and affects OpenSSL versions 1.1.1 (before 1.1.1zg), 3.0.0 (before 3.0.20), 3.3.0 (before 3.3.7), 3.4.0 (before 3.4.5), 3.5.0 (before 3.5.6), and 3.6.0 (before 3.6.2). The vulnerability is limited to an uncommon client configuration and does not affect FIPS modules. It carries a CVSS v3.1 base score of 8.1 (High) (OpenSSL Advisory, GitHub Advisory).

The root cause is an incorrect memory deallocation in the dane_match_cert() function (CWE-416: Use After Free). Specifically, the code called OPENSSL_free() on dane->mcert — a pointer to an X509 object — instead of the correct X509_free(), which properly handles reference counting for OpenSSL certificate objects. This mismatch can result in a use-after-free or double-free condition on the client side when processing TLSA records. The flaw is triggered only when a client simultaneously supports both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages and connects to a server publishing a TLSA RRset containing both types of records (OpenSSL Commit, OpenSSL Commit).

Successful exploitation can result in corruption of valid data, application crashes (denial of service), or potentially arbitrary code execution on the affected client. Confidentiality, integrity, and availability are all rated as high impact given the nature of use-after-free vulnerabilities. However, real-world impact is significantly constrained by the narrow exploitation preconditions — standard SMTP MTA deployments following RFC7672 and clients supporting only PKIX usages are not affected (OpenSSL Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.02%, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a highly specific client configuration — supporting both PKIX and DANE-TA certificate usages simultaneously — combined with a server publishing mixed TLSA record types, making opportunistic exploitation unlikely.

OpenSSL has released patched versions addressing this vulnerability: 1.1.1zg, 3.0.20, 3.3.7, 3.4.5, 3.5.6, and 3.6.2. Organizations should upgrade to the appropriate fixed version as the primary remediation. As a risk-reduction measure, organizations can assess whether their client applications use DANE TLSA authentication with both PKIX-TA/PKIX-EE and DANE-TA certificate usage types simultaneously; those that do not are not affected. Standard SMTP implementations following RFC7672 and clients supporting only PKIX usages require no immediate action (OpenSSL Advisory, GitHub Advisory).

The OpenSSL project published a formal security advisory on April 7, 2026, characterizing the issue as affecting an uncommon configuration and noting that FIPS modules are unaffected (OpenSSL Advisory). Multiple Linux distributions including Ubuntu, Debian, SUSE, Slackware, and Amazon Linux issued security advisories and updated packages shortly after disclosure. Microsoft Defender for Endpoint flagged the CVE, prompting community discussion on Reddit's r/sysadmin about the practical impact and whether patching was urgent given the narrow exploitation conditions. Security news outlets including Help Net Security and CyberSecurityNews covered the release of OpenSSL 3.6.2 and the broader set of fixes included in the April 2026 update.