CVE-2026-28387

/// Technical description

Issue summary: An uncommon configuration of clients performing DANE TLSA-based

server authentication, when paired with uncommon server DANE TLSA records, may

result in a use-after-free and/or double-free on the client side.

Impact summary: A use after free can have a range of potential consequences

such as the corruption of valid data, crashes or execution of arbitrary code.

However, the issue only affects clients that make use of TLSA records with both

the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate

usage.

By far the most common deployment of DANE is in SMTP MTAs for which RFC7672

recommends that clients treat as 'unusable' any TLSA records that have the PKIX

certificate usages. These SMTP (or other similar) clients are not vulnerable

to this issue. Conversely, any clients that support only the PKIX usages, and

ignore the DANE-TA(2) usage are also not vulnerable.

The client would also need to be communicating with a server that publishes a

TLSA RRset w

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References