OpenSSL X.509 policy memory leak (CVE-2026-28387)

Oct 14, 2026

Vulnerability ID	Vulnerability Overview
CVE-2026-28387	Evaluating X.509 certificate policies with deeply nested structures fails to free memory under specific error conditions. A remote attacker can exhaust system memory by sending a large volume of these crafted certificates.

Affected Supported TeraStations

TS71210
Fixed in firmware version 2.06

TS5020 / TS3030
Fixed in firmware version 3.16