CVE-2026-31790: 
OpenSSL vulnerability analysis and mitigation

CVE-2026-31790 is a memory disclosure vulnerability in OpenSSL's RSA/RSASVE key encapsulation mechanism (KEM) that allows an unauthenticated attacker to receive uninitialized or stale process memory contents in place of a legitimate KEM ciphertext. The flaw was disclosed on April 7, 2026, and affects OpenSSL versions 3.0.0–3.0.19, 3.3.0–3.3.6, 3.4.0–3.4.4, 3.5.0–3.5.5, and 3.6.0–3.6.1; the FIPS modules in versions 3.0, 3.1, 3.3, 3.4, 3.5, and 3.6 are also affected. It carries a CVSS v3.1 base score of 7.5 (High) with a network-accessible, unauthenticated attack vector and high confidentiality impact (OpenSSL Advisory, GitHub Advisory).

The root cause is an improper check for unusual or exceptional conditions (CWE-754) in the rsasve_generate() function within providers/implementations/kem/rsa_kem.c. The function calls RSA_public_encrypt(), which returns the number of bytes written on success or -1 on failure; however, the original code only tested if (ret) — a non-zero check — meaning a return value of -1 (failure) was treated as truthy and interpreted as success. As a result, when RSA encryption fails (e.g., due to an attacker-supplied invalid RSA public key), the encapsulation function still returns success, sets output lengths, and leaves the caller-provided ciphertext buffer — which may contain stale or uninitialized heap memory from prior process execution — to be transmitted to the peer. The fix tightens the check to if (ret <= 0 || ret != (int)nlen), ensuring only a positive return value matching the expected modulus-sized output is accepted (OpenSSL Commit, OpenSSL Commit).

Successful exploitation results in disclosure of uninitialized or stale heap memory from the application process to the attacker, with high confidentiality impact and no integrity or availability impact. The leaked memory may contain sensitive cryptographic material, session keys, credentials, or other sensitive data from prior operations within the same process. The vulnerability is exploitable over the network without authentication or user interaction, making it particularly dangerous in server-side applications that accept attacker-controlled RSA public keys for KEM operations without prior key validation (OpenSSL Advisory, GitHub Advisory).

1. Identify target application: Locate a server or application that uses OpenSSL's EVP_PKEY_encapsulate() with RSA/RSASVE key encapsulation and accepts externally supplied RSA public keys (e.g., in a custom key exchange protocol or cryptographic service).
2. Craft an invalid RSA public key: Generate a malformed or invalid RSA public key structure that will cause RSA_public_encrypt() to fail (return -1) when used in the encapsulation operation.
3. Submit the invalid key: Supply the crafted invalid RSA public key to the target application as part of a key encapsulation request, without the application first calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick().
4. Trigger the bug: The vulnerable rsasve_generate() function calls RSA_public_encrypt(), which fails and returns -1. The flawed if (ret) check treats -1 as success, causing the function to return success and set output lengths without writing valid ciphertext.
5. Receive leaked memory: The application transmits the contents of the uninitialized or stale ciphertext buffer to the attacker, potentially exposing sensitive data from prior process memory such as cryptographic keys or credentials (OpenSSL Advisory, OpenSSL Commit).

• Network: Unexpected or malformed RSA public key material submitted to services performing KEM operations; repeated KEM encapsulation requests with structurally invalid public keys from a single source IP.
• Logs: Application-level errors or warnings from OpenSSL related to RSA encryption failures that are not followed by a corresponding encapsulation failure response; anomalous KEM session establishment patterns where the server reports success despite invalid key input.
• Process/Memory: Applications transmitting fixed-size buffers (matching RSA modulus size) that contain non-random, potentially structured data rather than valid RSA ciphertext — detectable via protocol-level inspection if the KEM output is observable.
• File System: No specific file artifacts are associated with this vulnerability, as it is a transient memory disclosure with no persistent payload.

OpenSSL has released patched versions addressing this vulnerability: 3.0.20, 3.3.7, 3.4.5, 3.5.6, and 3.6.2. Organizations should upgrade to the appropriate patched version as the primary remediation (OpenSSL Advisory). As an immediate workaround for applications that cannot be patched immediately, call EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() to validate any RSA public key before passing it to EVP_PKEY_encapsulate(). Downstream distributions including Ubuntu (USN-8155-1/2), SUSE, openSUSE, Red Hat (RHSA-2026:12195, RHSA-2026:19066, RHSA-2026:19218, RHSA-2026:21275, RHSA-2026:22634), Amazon Linux 2023, and FreeBSD have also released updated packages (Ubuntu Advisory, Red Hat Advisory).

The OpenSSL project published a formal security advisory on April 7, 2026, classifying the issue as moderate severity (OpenSSL Advisory). Security news outlets including Help Net Security, GBHackers, CyberSecurityNews, and Cryptika covered the release of OpenSSL 3.6.2 and the associated CVE fixes, with coverage noting the memory disclosure risk in RSA KEM handling (Help Net Security). Microsoft also acknowledged the vulnerability through its Security Response Center for affected Azure Linux components (Microsoft MSRC). Community reaction was measured, with general consensus that the narrow attack surface (requiring attacker-controlled invalid RSA public keys) limits practical exploitation risk.