{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-01T15:28:15.870","vulnerabilities":[{"cve":{"id":"CVE-2026-2673","sourceIdentifier":"openssl-security@openssl.org","published":"2026-03-13T19:54:34.033","lastModified":"2026-06-17T10:31:30.993","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected\npreferred key exchange group when its key exchange group configuration includes\nthe default by using the 'DEFAULT' keyword.\n\nImpact summary: A less preferred key exchange may be used even when a more\npreferred group is supported by both client and server, if the group\nwas not included among the client's initial predicated keyshares.\nThis will sometimes be the case with the new hybrid post-quantum groups,\nif the client chooses to defer their use until specifically requested by\nthe server.\n\nIf an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to\ninterpolate the built-in default group list into its own configuration, perhaps\nadding or removing specific elements, then an implementation defect causes the\n'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups\nwere treated as a single sufficiently secure 'tuple', with the server not\nsending a Hello Retry Request (HRR) even when a group in a more preferred tuple\nwas mutually supported.\n\nAs a result, the client and server might fail to negotiate a mutually supported\npost-quantum key agreement group, such as 'X25519MLKEM768', if the client's\nconfiguration results in only 'classical' groups (such as 'X25519' being the\nonly ones in the client's initial keyshare prediction).\n\nOpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS\n1.3 key agreement group on TLS servers.  The old syntax had a single 'flat'\nlist of groups, and treated all the supported groups as sufficiently secure.\nIf any of the keyshares predicted by the client were supported by the server\nthe most preferred among these was selected, even if other groups supported by\nthe client, but not included in the list of predicted keyshares would have been\nmore preferred, if included.\n\nThe new syntax partitions the groups into distinct 'tuples' of roughly\nequivalent security.  Within each tuple the most preferred group included among\nthe client's predicted keyshares is chosen, but if the client supports a group\nfrom a more preferred tuple, but did not predict any corresponding keyshares,\nthe server will ask the client to retry the ClientHello (by issuing a Hello\nRetry Request or HRR) with the most preferred mutually supported group.\n\nThe above works as expected when the server's configuration uses the built-in\ndefault group list, or explicitly defines its own list by directly defining the\nvarious desired groups and group 'tuples'.\n\nNo OpenSSL FIPS modules are affected by this issue, the code in question lies\noutside the FIPS boundary.\n\nOpenSSL 3.6 and 3.5 are vulnerable to this issue.\n\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.\n\nOpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue."},{"lang":"es","value":"Resumen del problema: Un servidor OpenSSL TLS 1.3 puede fallar al negociar el grupo de intercambio de claves preferido esperado cuando su configuración de grupo de intercambio de claves incluye el predeterminado al usar la palabra clave 'DEFAULT'.\n\nResumen del impacto: Un intercambio de claves menos preferido puede ser usado incluso cuando un grupo más preferido es soportado tanto por el cliente como por el servidor, si el grupo no fue incluido entre los keyshares iniciales predichos del cliente. Este será a veces el caso con los nuevos grupos híbridos post-cuánticos, si el cliente elige aplazar su uso hasta que sea solicitado específicamente por el servidor.\n\nSi la configuración de un servidor OpenSSL TLS 1.3 usa la palabra clave 'DEFAULT' para interpolar la lista de grupos predeterminada incorporada en su propia configuración, quizás añadiendo o eliminando elementos específicos, entonces un defecto de implementación causa que la lista 'DEFAULT' pierda su estructura de 'tupla', y todos los grupos soportados por el servidor fueron tratados como una única 'tupla' suficientemente segura, con el servidor no enviando una Solicitud de Reintento de Hello (HRR) incluso cuando un grupo en una tupla más preferida era mutuamente soportado.\n\nComo resultado, el cliente y el servidor podrían fallar al negociar un grupo de acuerdo de clave post-cuántico mutuamente soportado, como 'X25519MLKEM768', si la configuración del cliente resulta en solo grupos 'clásicos' (como 'X25519' siendo los únicos en la predicción inicial de keyshare del cliente).\n\nOpenSSL 3.5 y posteriores soportan una nueva sintaxis para seleccionar el grupo de acuerdo de clave TLS 1.3 más preferido en servidores TLS. La sintaxis antigua tenía una única lista 'plana' de grupos, y trataba todos los grupos soportados como suficientemente seguros. Si alguno de los keyshares predichos por el cliente era soportado por el servidor, el más preferido entre estos era seleccionado, incluso si otros grupos soportados por el cliente, pero no incluidos en la lista de keyshares predichos, habrían sido más preferidos, si se hubieran incluido.\n\nLa nueva sintaxis particiona los grupos en 'tuplas' distintas de seguridad aproximadamente equivalente. Dentro de cada tupla se elige el grupo más preferido incluido entre los keyshares predichos del cliente, pero si el cliente soporta un grupo de una tupla más preferida, pero no predijo ningún keyshare correspondiente, el servidor pedirá al cliente que reintente el ClientHello (emitiendo una Solicitud de Reintento de Hello o HRR) con el grupo mutuamente soportado más preferido.\n\nLo anterior funciona como se espera cuando la configuración del servidor usa la lista de grupos predeterminada incorporada, o define explícitamente su propia lista definiendo directamente los diversos grupos y 'tuplas' de grupo deseados.\n\nNingún módulo FIPS de OpenSSL está afectado por este problema, el código en cuestión se encuentra fuera del límite FIPS.\n\nOpenSSL 3.6 y 3.5 son vulnerables a este problema.\n\nLos usuarios de OpenSSL 3.6 deberían actualizar a OpenSSL 3.6.2 una vez que sea lanzado.\nLos usuarios de OpenSSL 3.5 deberían actualizar a OpenSSL 3.5.6 una vez que sea lanzado.\n\nOpenSSL 3.4, 3.3, 3.0, 1.0.2 y 1.1.1 no están afectados por este problema."}],"affected":[{"source":"openssl-security@openssl.org","affectedData":[{"vendor":"OpenSSL","product":"OpenSSL","defaultStatus":"unaffected","versions":[{"version":"3.6.0","lessThan":"3.6.2","versionType":"semver","status":"affected"},{"version":"3.5.0","lessThan":"3.5.6","versionType":"semver","status":"affected"}]}]},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","affectedData":[{"vendor":"Siemens","product":"SIMATIC CN 4100","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"V5.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-17T17:17:17.444679Z","id":"CVE-2026-2673","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"openssl-security@openssl.org","type":"Secondary","description":[{"lang":"en","value":"CWE-757"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5.0","versionEndExcluding":"3.5.6","matchCriteriaId":"F6BC0271-444D-4597-BF05-DC60034EAA49"},{"vulnerable":true,"criteria":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6.0","versionEndExcluding":"3.6.2","matchCriteriaId":"4A9E621D-29D8-418A-BF37-BED333C14507"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:siemens:simatic_cn_4100_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"5.0","matchCriteriaId":"AA9D4F6E-9336-4026-B485-4227C861B356"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:siemens:simatic_cn_4100:-:*:*:*:*:*:*:*","matchCriteriaId":"92619F5F-3679-4424-9455-3285FF1EF2F1"}]}]}],"references":[{"url":"https://github.com/openssl/openssl/commit/2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f","source":"openssl-security@openssl.org","tags":["Patch"]},{"url":"https://github.com/openssl/openssl/commit/85977e013f32ceb96aa034c0e741adddc1a05e34","source":"openssl-security@openssl.org","tags":["Patch"]},{"url":"https://openssl-library.org/news/secadv/20260313.txt","source":"openssl-security@openssl.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/13/3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html","source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"]}]}}]}