{"id":"UBUNTU-CVE-2026-31790","details":"Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.","modified":"2026-09-15T08:31:33.946820237Z","published":"2026-04-07T00:00:00Z","related":["USN-8155-1"],"upstream":["CVE-2026-31790"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-31790"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-31790"},{"type":"REPORT","url":"https://www.openwall.com/lists/oss-security/2026/04/07/11"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8155-1"}],"affected":[{"package":{"name":"openssl","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.23"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16","3.0.2-0ubuntu1.17","3.0.2-0ubuntu1.18","3.0.2-0ubuntu1.19","3.0.2-0ubuntu1.20","3.0.2-0ubuntu1.21"],"ecosystem_specific":{"binaries":[{"binary_name":"libssl3","binary_version":"3.0.2-0ubuntu1.23"},{"binary_name":"openssl","binary_version":"3.0.2-0ubuntu1.23"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31790.json"}},{"package":{"name":"openssl","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=fips-preview%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1"],"ecosystem_specific":{"binaries":[{"binary_name":"libssl3","binary_version":"3.0.2-0ubuntu1.12+Fips1"},{"binary_name":"openssl","binary_version":"3.0.2-0ubuntu1.12+Fips1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31790.json"}},{"package":{"name":"openssl-fips","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","purl":"pkg:deb/ubuntu/openssl-fips?arch=source&distro=fips-preview%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5-0ubuntu0.1+Fips2.1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.0.5-0ubuntu0.1+Fips2.1","binary_name":"openssl-fips-module-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31790.json"}},{"package":{"name":"openssl","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=fips-updates%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1","3.0.2-0ubuntu1.14+Fips1","3.0.2-0ubuntu1.15+Fips1","3.0.2-0ubuntu1.16+Fips1","3.0.2-0ubuntu1.17+Fips1","3.0.2-0ubuntu1.18+Fips1","3.0.2-0ubuntu1.19+Fips1","3.0.2-0ubuntu1.20+Fips1","3.0.2-0ubuntu1.21+Fips1","3.0.2-0ubuntu1.23+Fips1","3.0.2-0ubuntu1.25+Fips1","3.0.2-0ubuntu1.26+Fips1","3.0.2-0ubuntu1.29+Fips1"],"ecosystem_specific":{"binaries":[{"binary_name":"libssl3","binary_version":"3.0.2-0ubuntu1.29+Fips1"},{"binary_name":"openssl","binary_version":"3.0.2-0ubuntu1.29+Fips1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31790.json"}},{"package":{"name":"openssl-fips","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","purl":"pkg:deb/ubuntu/openssl-fips?arch=source&distro=fips-updates%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5-0ubuntu0.1+Fips2.1","3.0.5-0ubuntu0.2+Fips1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.0.5-0ubuntu0.2+Fips1","binary_name":"openssl-fips-module-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31790.json"}},{"package":{"name":"edk2","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/edk2?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5","2024.02-2ubuntu0.6","2024.02-2ubuntu0.7","2024.02-2ubuntu0.8","2024.02-2ubuntu0.9"],"ecosystem_specific":{"binaries":[{"binary_name":"efi-shell-aa64","binary_version":"2024.02-2ubuntu0.9"},{"binary_name":"efi-shell-arm","binary_version":"2024.02-2ubuntu0.9"},{"binary_name":"efi-shell-ia32","binary_version":"2024.02-2ubuntu0.9"},{"binary_version":"2024.02-2ubuntu0.9","binary_name":"efi-shell-riscv64"},{"binary_name":"efi-shell-x64","binary_version":"2024.02-2ubuntu0.9"},{"binary_name":"ovmf","binary_version":"2024.02-2ubuntu0.9"},{"binary_name":"ovmf-ia32","binary_version":"2024.02-2ubuntu0.9"},{"binary_version":"2024.02-2ubuntu0.9","binary_name":"ovmf-legacy"},{"binary_name":"qemu-efi-aarch64","binary_version":"2024.02-2ubuntu0.9"},{"binary_name":"qemu-efi-arm","binary_version":"2024.02-2ubuntu0.9"},{"binary_name":"qemu-efi-riscv64","binary_version":"2024.02-2ubuntu0.9"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31790.json"}},{"package":{"name":"openssl","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.9"}]}],"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1","3.0.13-0ubuntu3.2","3.0.13-0ubuntu3.3","3.0.13-0ubuntu3.4","3.0.13-0ubuntu3.5","3.0.13-0ubuntu3.6","3.0.13-0ubuntu3.7"],"ecosystem_specific":{"binaries":[{"binary_name":"libssl3t64","binary_version":"3.0.13-0ubuntu3.9"},{"binary_name":"openssl","binary_version":"3.0.13-0ubuntu3.9"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31790.json"}},{"package":{"name":"openssl-fips","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","purl":"pkg:deb/ubuntu/openssl-fips?arch=source&distro=fips-updates%2Fnoble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.12+Fips1"}]}],"versions":["3.0.13-0ubuntu3+Fips1","3.0.13-0ubuntu3.6+Fips1"],"ecosystem_specific":{"binaries":[{"binary_name":"openssl-fips-module-3","binary_version":"3.0.13-0ubuntu3.12+Fips1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31790.json"}},{"package":{"name":"edk2","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/edk2?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-3ubuntu2","2025.02-8","2025.02-8ubuntu1","2025.02-8ubuntu2","2025.02-8ubuntu3","2025.02-8ubuntu3.1","2025.02-8ubuntu3.2"],"ecosystem_specific":{"binaries":[{"binary_version":"2025.02-8ubuntu3.2","binary_name":"efi-shell-aa64"},{"binary_name":"efi-shell-arm","binary_version":"2025.02-8ubuntu3.2"},{"binary_name":"efi-shell-ia32","binary_version":"2025.02-8ubuntu3.2"},{"binary_name":"efi-shell-loongarch64","binary_version":"2025.02-8ubuntu3.2"},{"binary_version":"2025.02-8ubuntu3.2","binary_name":"efi-shell-riscv64"},{"binary_name":"efi-shell-x64","binary_version":"2025.02-8ubuntu3.2"},{"binary_version":"2025.02-8ubuntu3.2","binary_name":"ovmf"},{"binary_name":"ovmf-ia32","binary_version":"2025.02-8ubuntu3.2"},{"binary_name":"ovmf-inteltdx","binary_version":"2025.02-8ubuntu3.2"},{"binary_name":"ovmf-legacy","binary_version":"2025.02-8ubuntu3.2"},{"binary_version":"2025.02-8ubuntu3.2","binary_name":"qemu-efi-aarch64"},{"binary_version":"2025.02-8ubuntu3.2","binary_name":"qemu-efi-arm"},{"binary_name":"qemu-efi-loongarch64","binary_version":"2025.02-8ubuntu3.2"},{"binary_version":"2025.02-8ubuntu3.2","binary_name":"qemu-efi-riscv64"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31790.json"}},{"package":{"name":"openssl","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1ubuntu3.3"}]}],"versions":["3.4.1-1ubuntu3","3.5.0-2ubuntu1","3.5.2-1ubuntu1","3.5.3-1ubuntu2","3.5.3-1ubuntu3"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"3.5.3-1ubuntu3.3","binary_name":"libssl3t64"},{"binary_name":"openssl","binary_version":"3.5.3-1ubuntu3.3"},{"binary_version":"3.5.3-1ubuntu3.3","binary_name":"openssl-provider-legacy"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31790.json"}},{"package":{"name":"edk2","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/edk2?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-8ubuntu3","2025.11-3ubuntu6","2025.11-3ubuntu7","2025.11-3ubuntu7.2"],"ecosystem_specific":{"binaries":[{"binary_version":"2025.11-3ubuntu7.2","binary_name":"efi-shell-aa64"},{"binary_name":"efi-shell-loongarch64","binary_version":"2025.11-3ubuntu7.2"},{"binary_name":"efi-shell-riscv64","binary_version":"2025.11-3ubuntu7.2"},{"binary_name":"efi-shell-x64","binary_version":"2025.11-3ubuntu7.2"},{"binary_name":"ovmf","binary_version":"2025.11-3ubuntu7.2"},{"binary_name":"ovmf-amdsev","binary_version":"2025.11-3ubuntu7.2"},{"binary_name":"ovmf-generic","binary_version":"2025.11-3ubuntu7.2"},{"binary_name":"ovmf-inteltdx","binary_version":"2025.11-3ubuntu7.2"},{"binary_version":"2025.11-3ubuntu7.2","binary_name":"ovmf-legacy"},{"binary_name":"qemu-efi-aarch64","binary_version":"2025.11-3ubuntu7.2"},{"binary_name":"qemu-efi-loongarch64","binary_version":"2025.11-3ubuntu7.2"},{"binary_name":"qemu-efi-riscv64","binary_version":"2025.11-3ubuntu7.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31790.json"}},{"package":{"name":"edk2-hwe","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/edk2-hwe?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu6","2025.11-3ubuntu8","2025.11-3ubuntu8.2"],"ecosystem_specific":{"binaries":[{"binary_name":"efi-shell-aa64-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_name":"efi-shell-loongarch64-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_version":"2025.11-3ubuntu8.2","binary_name":"efi-shell-riscv64-hwe"},{"binary_name":"efi-shell-x64-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_version":"2025.11-3ubuntu8.2","binary_name":"ovmf-amdsev-hwe"},{"binary_version":"2025.11-3ubuntu8.2","binary_name":"ovmf-generic-hwe"},{"binary_name":"ovmf-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_version":"2025.11-3ubuntu8.2","binary_name":"ovmf-inteltdx-hwe"},{"binary_name":"ovmf-legacy-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_version":"2025.11-3ubuntu8.2","binary_name":"qemu-efi-aarch64-hwe"},{"binary_name":"qemu-efi-loongarch64-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_name":"qemu-efi-riscv64-hwe","binary_version":"2025.11-3ubuntu8.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31790.json"}},{"package":{"name":"openssl","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu3"}]}],"versions":["3.5.3-1ubuntu2","3.5.5-1ubuntu1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"libssl3t64","binary_version":"3.5.5-1ubuntu3"},{"binary_name":"openssl","binary_version":"3.5.5-1ubuntu3"},{"binary_name":"openssl-provider-legacy","binary_version":"3.5.5-1ubuntu3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31790.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]}