CVE-2026-7531

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 5.9.1

Description A use-after-free issue exists in the handling of PQC hybrid key-shares. A malicious TLS 1.3 server can send a truncated PQC hybrid KeyShare, which triggers an error cleanup path that operates on memory that has already been freed. PQC refers to Post-Quantum Cryptography, which are cryptographic algorithms designed to be secure against attacks by quantum computers.

Recommendations Update to version 5.9.1 or later.