CVE-2026-28387: DANE TLSA Use-After-Free Vulnerability

CVE-2026-28387 Overview

CVE-2026-28387 is a use-after-free and potential double-free vulnerability affecting OpenSSL clients configured to perform DANE TLSA-based server authentication. When specific TLSA record configurations are present, the improper memory management in the certificate matching process can lead to memory corruption, application crashes, or potentially arbitrary code execution.

Critical Impact

A use-after-free vulnerability in OpenSSL's DANE TLSA certificate validation can result in memory corruption, denial of service, or arbitrary code execution on affected client systems.

Affected Products

• OpenSSL clients using DANE TLSA-based server authentication
• Systems configured with PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages
• Non-FIPS OpenSSL deployments (FIPS modules are not affected)

Discovery Timeline

• 2026-04-07 - CVE-2026-28387 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-28387

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption issue that occurs when a program continues to use a pointer after the memory it references has been freed. In the context of OpenSSL's DANE TLSA implementation, the vulnerability manifests during certificate matching operations when clients support both PKIX certificate usages (PKIX-TA(0)/PKIX-EE(1)) and DANE-TA(2) certificate usages simultaneously.

The exploitation requires a specific combination: a client must be configured to process both PKIX and DANE-TA certificate usages, and it must connect to a server that publishes a TLSA RRset containing both types of TLSA records. While this configuration is uncommon—particularly in SMTP MTAs where RFC7672 recommends treating PKIX certificate usages as 'unusable'—affected deployments face serious risks including memory corruption and potential code execution.

Root Cause

The root cause of CVE-2026-28387 lies in the dane_match_cert() function within crypto/x509/x509_vfy.c. The vulnerability stems from an incorrect memory deallocation function being used to free X509 certificate objects. The code incorrectly used OPENSSL_free() to deallocate the dane->mcert X509 certificate structure instead of the proper X509_free() function.

Using OPENSSL_free() instead of X509_free() fails to properly decrement reference counts and release associated resources, leading to a use-after-free condition when the certificate memory is later accessed or when the same memory is freed again through proper channels.

Attack Vector

The attack requires a malicious or compromised server to publish specially crafted TLSA records containing both PKIX certificate usages (PKIX-TA(0) or PKIX-EE(1)) and DANE-TA(2) certificate usage. When a vulnerable client connects to such a server and performs DANE TLSA-based authentication, the improper memory handling triggers the use-after-free condition.

The following patches demonstrate the security fix applied to the dane_match_cert() function:

// Patch 1 - crypto/x509/x509_vfy.c
// Source: https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b
             if (matched || dane->mdpth < 0) {
                 dane->mdpth = depth;
                 dane->mtlsa = t;
-                OPENSSL_free(dane->mcert);
+                X509_free(dane->mcert);
                 dane->mcert = cert;
                 X509_up_ref(cert);
             }

// Patch 2 - crypto/x509/x509_vfy.c
// Source: https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe
                     break;
                 }

-                OPENSSL_free(dane->mcert);
+                X509_free(dane->mcert);
                 dane->mcert = cert;
                 dane->mdpth = depth;
                 dane->mtlsa = t;

Detection Methods for CVE-2026-28387

Indicators of Compromise

• Unexpected crashes or segmentation faults in applications using OpenSSL for TLS connections
• Memory corruption errors or heap corruption warnings in application logs
• Abnormal DNS TLSA record queries combining multiple certificate usage types
• Core dumps from OpenSSL-dependent services showing corruption in certificate handling code paths

Detection Strategies

• Monitor application crash logs for segmentation faults originating from x509_vfy.c or certificate verification functions
• Implement DNS monitoring to detect servers publishing unusual TLSA RRsets with combined PKIX and DANE-TA certificate usages
• Deploy memory debugging tools (AddressSanitizer, Valgrind) in development environments to detect use-after-free conditions
• Review OpenSSL version information across deployed systems to identify vulnerable installations

Monitoring Recommendations

• Enable verbose logging for TLS handshake failures and certificate validation errors
• Set up alerts for application crashes involving OpenSSL shared libraries
• Monitor for unusual patterns in DANE TLSA lookups that could indicate reconnaissance activity
• Implement system stability monitoring for services that rely on OpenSSL for certificate validation

How to Mitigate CVE-2026-28387

Immediate Actions Required

• Identify all systems using OpenSSL with DANE TLSA-based server authentication enabled
• Review DANE configuration to determine if both PKIX (0/1) and DANE-TA(2) certificate usages are enabled
• Consider disabling PKIX certificate usages in DANE configurations as recommended by RFC7672 for SMTP MTAs
• Plan for immediate patching of affected OpenSSL installations

Patch Information

OpenSSL has released security patches addressing this vulnerability. The fix corrects the improper memory deallocation in the dane_match_cert() function by replacing OPENSSL_free(dane->mcert) with the proper X509_free(dane->mcert) call. Users should update to patched OpenSSL versions as detailed in the OpenSSL Security Advisory.

Multiple commits address this issue across different OpenSSL branches:

• Commit 07e727d
• Commit 258a8f6
• Commit 444958d
• Commit 7a4e08c
• Commit ec03fa0

Workarounds

• Disable DANE TLSA authentication if not strictly required until patching is complete
• Configure clients to use only DANE-TA(2) or DANE-EE(3) certificate usages, avoiding PKIX usages entirely
• For SMTP MTAs, follow RFC7672 guidance to treat PKIX certificate usages as 'unusable'
• Deploy network-level controls to block connections to servers with suspicious TLSA record configurations

# Verify OpenSSL version and check for vulnerability
openssl version -a

# Check if DANE TLSA is enabled in your configuration
grep -r "DANE" /etc/ssl/ /etc/pki/ 2>/dev/null

# Monitor for certificate validation issues
journalctl -u your-service-name | grep -i "certificate\|dane\|tlsa"