UBUNTU-CVE-2026-31789

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-31789

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31789.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2026-31789

Upstream

CVE-2026-31789

Downstream

USN-8155-1

Related

USN-8155-1

Published

2026-04-07T00:00:00Z

Modified

2026-04-27T20:02:21.297490Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Ubuntu - low

Summary

[none]

Details

Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow. Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

References

Affected packages

Ubuntu:22.04:LTS

openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.23?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.2-0ubuntu1.23

Affected versions

1.*

1.1.1l-1ubuntu1

3.*

3.0.0-1ubuntu1

3.0.1-0ubuntu1

3.0.2-0ubuntu1

3.0.2-0ubuntu1.1

3.0.2-0ubuntu1.2

3.0.2-0ubuntu1.4

3.0.2-0ubuntu1.5

3.0.2-0ubuntu1.6

3.0.2-0ubuntu1.7

3.0.2-0ubuntu1.8

3.0.2-0ubuntu1.9

3.0.2-0ubuntu1.10

3.0.2-0ubuntu1.12

3.0.2-0ubuntu1.13

3.0.2-0ubuntu1.14

3.0.2-0ubuntu1.15

3.0.2-0ubuntu1.16

3.0.2-0ubuntu1.17

3.0.2-0ubuntu1.18

3.0.2-0ubuntu1.19

3.0.2-0ubuntu1.20

3.0.2-0ubuntu1.21

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "3.0.2-0ubuntu1.23",
            "binary_name": "libssl3"
        },
        {
            "binary_version": "3.0.2-0ubuntu1.23",
            "binary_name": "openssl"
        }
    ],
    "priority_reason": "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31789.json"

Ubuntu:24.04:LTS

edk2

Package

Name: edk2
Purl: pkg:deb/ubuntu/edk2@2024.02-2ubuntu0.8?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2023.*

2023.05-2

2023.11-2

2023.11-3

2023.11-4

2023.11-5

2023.11-6

2023.11-8

2024.*

2024.02-1

2024.02-2

2024.02-2ubuntu0.1

2024.02-2ubuntu0.3

2024.02-2ubuntu0.4

2024.02-2ubuntu0.5

2024.02-2ubuntu0.6

2024.02-2ubuntu0.7

2024.02-2ubuntu0.8

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2024.02-2ubuntu0.8",
            "binary_name": "efi-shell-aa64"
        },
        {
            "binary_version": "2024.02-2ubuntu0.8",
            "binary_name": "efi-shell-arm"
        },
        {
            "binary_version": "2024.02-2ubuntu0.8",
            "binary_name": "efi-shell-ia32"
        },
        {
            "binary_version": "2024.02-2ubuntu0.8",
            "binary_name": "efi-shell-riscv64"
        },
        {
            "binary_version": "2024.02-2ubuntu0.8",
            "binary_name": "efi-shell-x64"
        },
        {
            "binary_version": "2024.02-2ubuntu0.8",
            "binary_name": "ovmf"
        },
        {
            "binary_version": "2024.02-2ubuntu0.8",
            "binary_name": "ovmf-ia32"
        },
        {
            "binary_version": "2024.02-2ubuntu0.8",
            "binary_name": "ovmf-legacy"
        },
        {
            "binary_version": "2024.02-2ubuntu0.8",
            "binary_name": "qemu-efi-aarch64"
        },
        {
            "binary_version": "2024.02-2ubuntu0.8",
            "binary_name": "qemu-efi-arm"
        },
        {
            "binary_version": "2024.02-2ubuntu0.8",
            "binary_name": "qemu-efi-riscv64"
        }
    ],
    "priority_reason": "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31789.json"

openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.9?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.13-0ubuntu3.9

Affected versions

3.*

3.0.10-1ubuntu2

3.0.10-1ubuntu2.1

3.0.10-1ubuntu3

3.0.10-1ubuntu4

3.0.13-0ubuntu2

3.0.13-0ubuntu3

3.0.13-0ubuntu3.1

3.0.13-0ubuntu3.2

3.0.13-0ubuntu3.3

3.0.13-0ubuntu3.4

3.0.13-0ubuntu3.5

3.0.13-0ubuntu3.6

3.0.13-0ubuntu3.7

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "3.0.13-0ubuntu3.9",
            "binary_name": "libssl3t64"
        },
        {
            "binary_version": "3.0.13-0ubuntu3.9",
            "binary_name": "openssl"
        }
    ],
    "priority_reason": "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31789.json"

Ubuntu:25.10

edk2

Package

Name: edk2
Purl: pkg:deb/ubuntu/edk2@2025.02-8ubuntu3.1?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2025.*

2025.02-3ubuntu2

2025.02-8

2025.02-8ubuntu1

2025.02-8ubuntu2

2025.02-8ubuntu3

2025.02-8ubuntu3.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2025.02-8ubuntu3.1",
            "binary_name": "efi-shell-aa64"
        },
        {
            "binary_version": "2025.02-8ubuntu3.1",
            "binary_name": "efi-shell-arm"
        },
        {
            "binary_version": "2025.02-8ubuntu3.1",
            "binary_name": "efi-shell-ia32"
        },
        {
            "binary_version": "2025.02-8ubuntu3.1",
            "binary_name": "efi-shell-loongarch64"
        },
        {
            "binary_version": "2025.02-8ubuntu3.1",
            "binary_name": "efi-shell-riscv64"
        },
        {
            "binary_version": "2025.02-8ubuntu3.1",
            "binary_name": "efi-shell-x64"
        },
        {
            "binary_version": "2025.02-8ubuntu3.1",
            "binary_name": "ovmf"
        },
        {
            "binary_version": "2025.02-8ubuntu3.1",
            "binary_name": "ovmf-ia32"
        },
        {
            "binary_version": "2025.02-8ubuntu3.1",
            "binary_name": "ovmf-inteltdx"
        },
        {
            "binary_version": "2025.02-8ubuntu3.1",
            "binary_name": "ovmf-legacy"
        },
        {
            "binary_version": "2025.02-8ubuntu3.1",
            "binary_name": "qemu-efi-aarch64"
        },
        {
            "binary_version": "2025.02-8ubuntu3.1",
            "binary_name": "qemu-efi-arm"
        },
        {
            "binary_version": "2025.02-8ubuntu3.1",
            "binary_name": "qemu-efi-loongarch64"
        },
        {
            "binary_version": "2025.02-8ubuntu3.1",
            "binary_name": "qemu-efi-riscv64"
        }
    ],
    "priority_reason": "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31789.json"

openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl@3.5.3-1ubuntu3.3?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.5.3-1ubuntu3.3

Affected versions

3.*

3.4.1-1ubuntu3

3.5.0-2ubuntu1

3.5.2-1ubuntu1

3.5.3-1ubuntu2

3.5.3-1ubuntu3

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "3.5.3-1ubuntu3.3",
            "binary_name": "libssl3t64"
        },
        {
            "binary_version": "3.5.3-1ubuntu3.3",
            "binary_name": "openssl"
        },
        {
            "binary_version": "3.5.3-1ubuntu3.3",
            "binary_name": "openssl-provider-legacy"
        }
    ],
    "priority_reason": "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31789.json"

Ubuntu:26.04

edk2

Package

Name: edk2
Purl: pkg:deb/ubuntu/edk2@2025.11-3ubuntu7?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2025.*

2025.02-8ubuntu3

2025.11-3ubuntu6

2025.11-3ubuntu7

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2025.11-3ubuntu7",
            "binary_name": "efi-shell-aa64"
        },
        {
            "binary_version": "2025.11-3ubuntu7",
            "binary_name": "efi-shell-loongarch64"
        },
        {
            "binary_version": "2025.11-3ubuntu7",
            "binary_name": "efi-shell-riscv64"
        },
        {
            "binary_version": "2025.11-3ubuntu7",
            "binary_name": "efi-shell-x64"
        },
        {
            "binary_version": "2025.11-3ubuntu7",
            "binary_name": "ovmf"
        },
        {
            "binary_version": "2025.11-3ubuntu7",
            "binary_name": "ovmf-amdsev"
        },
        {
            "binary_version": "2025.11-3ubuntu7",
            "binary_name": "ovmf-generic"
        },
        {
            "binary_version": "2025.11-3ubuntu7",
            "binary_name": "ovmf-inteltdx"
        },
        {
            "binary_version": "2025.11-3ubuntu7",
            "binary_name": "ovmf-legacy"
        },
        {
            "binary_version": "2025.11-3ubuntu7",
            "binary_name": "qemu-efi-aarch64"
        },
        {
            "binary_version": "2025.11-3ubuntu7",
            "binary_name": "qemu-efi-loongarch64"
        },
        {
            "binary_version": "2025.11-3ubuntu7",
            "binary_name": "qemu-efi-riscv64"
        }
    ],
    "priority_reason": "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31789.json"

openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.5.5-1ubuntu3

Affected versions

3.*

3.5.3-1ubuntu2

3.5.5-1ubuntu1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "3.5.5-1ubuntu3",
            "binary_name": "libssl3t64"
        },
        {
            "binary_version": "3.5.5-1ubuntu3",
            "binary_name": "openssl"
        },
        {
            "binary_version": "3.5.5-1ubuntu3",
            "binary_name": "openssl-provider-legacy"
        }
    ],
    "priority_reason": "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31789.json"

Ubuntu:Pro:FIPS-preview:22.04:LTS

openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.12+Fips1?arch=source&distro=fips-preview/jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.2-0ubuntu1.10+Fips1

3.0.2-0ubuntu1.12+Fips1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.0.2-0ubuntu1.12+Fips1",
            "binary_name": "libssl3"
        },
        {
            "binary_version": "3.0.2-0ubuntu1.12+Fips1",
            "binary_name": "openssl"
        }
    ],
    "priority_reason": "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31789.json"

openssl-fips

Package

Name: openssl-fips
Purl: pkg:deb/ubuntu/openssl-fips@3.0.5-0ubuntu0.1+Fips2.1?arch=source&distro=fips-preview/jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.5-0ubuntu0.1+Fips2.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.0.5-0ubuntu0.1+Fips2.1",
            "binary_name": "openssl-fips-module-3"
        }
    ],
    "priority_reason": "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31789.json"

Ubuntu:Pro:FIPS-updates:22.04:LTS

openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl@3.0.2-0ubuntu1.23+Fips1?arch=source&distro=fips-updates/jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.2-0ubuntu1.10+Fips1

3.0.2-0ubuntu1.12+Fips1

3.0.2-0ubuntu1.14+Fips1

3.0.2-0ubuntu1.15+Fips1

3.0.2-0ubuntu1.16+Fips1

3.0.2-0ubuntu1.17+Fips1

3.0.2-0ubuntu1.18+Fips1

3.0.2-0ubuntu1.19+Fips1

3.0.2-0ubuntu1.20+Fips1

3.0.2-0ubuntu1.21+Fips1

3.0.2-0ubuntu1.23+Fips1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.0.2-0ubuntu1.23+Fips1",
            "binary_name": "libssl3"
        },
        {
            "binary_version": "3.0.2-0ubuntu1.23+Fips1",
            "binary_name": "openssl"
        }
    ],
    "priority_reason": "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31789.json"

openssl-fips

Package

Name: openssl-fips
Purl: pkg:deb/ubuntu/openssl-fips@3.0.5-0ubuntu0.2+Fips1?arch=source&distro=fips-updates/jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.5-0ubuntu0.1+Fips2.1

3.0.5-0ubuntu0.2+Fips1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.0.5-0ubuntu0.2+Fips1",
            "binary_name": "openssl-fips-module-3"
        }
    ],
    "priority_reason": "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31789.json"

Ubuntu:Pro:FIPS-updates:24.04:LTS

openssl-fips

Package

Name: openssl-fips
Purl: pkg:deb/ubuntu/openssl-fips@3.0.13-0ubuntu3.6+Fips1?arch=source&distro=fips-updates/noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.13-0ubuntu3+Fips1

3.0.13-0ubuntu3.6+Fips1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.0.13-0ubuntu3.6+Fips1",
            "binary_name": "openssl-fips-module-3"
        }
    ],
    "priority_reason": "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31789.json"