Why SolarWinds Observability Self-Hosted is not affected by CVE-2026-34182, CVE-2026-42766, CVE-2026-42767, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447 and CVE-2026-9076

In 2026, the National Institute of Standards and Technology (NIST) published a security bulletin about NVD - CVE-2026-34182 , NVD - CVE-2026-42766, NVD - CVE-2026-42767, NVD - CVE-2026-42770, NVD - CVE-2026-45445, NVD - CVE-2026-45446, NVD - CVE-2026-45447, and NVD - CVE-2026-9076.

CVE-2026-34182, is a cryptographic validation vulnerability in OpenSSL. . Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message.. The FIPS modules are not affected by this issue.

CVE-2026-42766 is a NULL pointer dereference vulnerability in OpenSSL. A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present. An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service. Applications that process password-encrypted CMS messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

CVE-2026-42767 is a NULL pointer dereference vulnerability in OpenSSL. An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client. Applications that process untrusted CMP/CRMF messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

CVE-2026-42770 is a cryptographic validation vulnerability in OpenSSL DHX (X9.42) key exchange that uses attacker-supplied domain parameters during subgroup validation. The issue is exploitable when an application accepts malicious X9.42 DHX peer keys, allowing an attacker to provide a forged q value and a public value from a small subgroup. Successful exploitation can leak information about the victim's private key and, after repeated key exchanges, potentially recover the complete private key.

CVE-2026-45445 is a cryptographic implementation vulnerability in OpenSSL AES-OCB when the cipher is used through the one-shot EVP_Cipher() interface. The issue causes the application-supplied initialization vector to be silently discarded, resulting in reuse of the same effective nonce for messages encrypted under the same key. Successful exploitation can lead to loss of confidentiality and, when authentication tags are generated through the affected code path, potentially allow forgery of arbitrary ciphertext. Applications using the documented streaming EVP_CipherUpdate() / EVP_CipherFinal_ex() interface are not affected.

CVE-2026-45446 is an authentication validation vulnerability in OpenSSL AES-SIV and AES-GCM-SIV implementations when processing messages with empty ciphertext. The issue occurs when an application supplies authenticated additional data but does not perform a ciphertext update before calling the final decryption operation, causing the expected authentication tag to be calculated incorrectly. Successful exploitation can allow an attacker to forge empty messages with arbitrary authenticated data, compromising message integrity.

CVE-2026-45447 is a use-after-free vulnerability in the OpenSSL PKCS7_verify() function that can be triggered by a specially crafted PKCS#7 or S/MIME signed message. The issue occurs when the SignedData.digestAlgorithms field is present as an empty ASN.1 SET and OpenSSL incorrectly frees a BIO owned by the calling application. Successful exploitation can cause application crashes or heap corruption and, depending on the application and memory allocator behavior, may potentially lead to remote code execution. Applications using the CMS APIs for equivalent processing are not affected.

CVE-2026-9076 is a heap out-of-bounds read vulnerability in OpenSSL CMS password-based decryption. The issue is exploitable when an application processes attacker-supplied CMS data containing a password-based key-encryption algorithm that specifies a stream-mode cipher, causing the key-unwrapping code to read beyond the allocated buffer. Successful exploitation can crash the application and cause a denial of service, but the over-read does not disclose the affected memory to the attacker and does not lead to information disclosure.

Although SolarWinds Observability Self-Hosted includes multiple versions of OpenSSL affected by these vulnerabilities, the product is not impacted because it does not use the vulnerable functions involved.