AZL-105567 CVE-2026-84782 affecting package openssl 3.3.7-6

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly...

AZL-105585 CVE-2026-84784 affecting package openssl 3.3.7-6

Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRECONNID frame for every NEWCONNECTIONID frame it receives. The...

AZL-105363 CVE-2026-84782 affecting package openssl-fips-provider 3.1.2-2

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly...

ALPINE-CVE-2026-84784

Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRECONNID frame for every NEWCONNECTIONID frame it receives. The...

AZL-105879 CVE-2026-84784 affecting package rust 1.96.1-2

Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRECONNID frame for every NEWCONNECTIONID frame it receives. The...

DEBIAN-CVE-2026-84784

Issue summary: A malicious remote peer may flood the local QUIC stack with NEWCONNECTIONID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRECONNID frame for every NEWCONNECTIONID frame it receives. The...

CVE-2026-84782

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly...

AZL-105369 CVE-2026-75805 affecting package openssl-fips-provider 3.1.2-2

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

CVE-2026-75805

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

AZL-105570 CVE-2026-77696 affecting package openssl 3.3.7-6

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

AZL-105366 CVE-2026-77696 affecting package openssl-fips-provider 3.1.2-2

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

AZL-105354 CVE-2026-75806 affecting package openssl-fips-provider 3.1.2-2

Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is rout...

AZL-105597 CVE-2026-75806 affecting package openssl 3.3.7-6

Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is rout...

ALPINE-CVE-2026-75805

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

AZL-105852 CVE-2026-75805 affecting package rust 1.75.0-31

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

AZL-105591 CVE-2026-75805 affecting package openssl 3.3.7-6

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

AZL-105891 CVE-2026-75805 affecting package rust 1.96.1-2

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

DEBIAN-CVE-2026-75805

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

CVE-2026-75804

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

AZL-105855 CVE-2026-75804 affecting package rust 1.75.0-31

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...