CVE-2026-84782

A flaw in OpenSSL 's DTLS retransmission mechanism fails to correctly handle handshake message writes that are suspended mid-process (returning WANT_WRITE). If a retransmission timer fires while a write is suspended, the logic may reuse internal buffers and position tracking without resetting to ...

CVE-2026-84782 DTLS Retransmits Handshake Messages From a Stale Buffer Offset

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly...

CVE-2026-84782

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly...

CVE-2026-75805 NULL Pointer Dereference in CMP Client Revocation Response Handling

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

EUVD-2026-89010

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

CVE-2026-75805 NULL Pointer Dereference in CMP Client Revocation Response Handling

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

CVE-2026-75805 NULL Pointer Dereference in CMP Client Revocation Response Handling

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

CVE-2026-75805

A NULL pointer dereference vulnerability exists in OpenSSL within the Certificate Management Protocol (CMP) client. When a client requests certificate revocation using a PKCS#10 CSR (e.g., via openssl cmp -cmd rr -csr or the OSSL_CMP_exec_RR_ses() API), it fails to send the issuer name and seria...

CVE-2026-75805

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

CVE-2026-75804

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

EUVD-2026-89009

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-75804

The OpenSSL QUIC stack fails to enforce connection-level flow control for streams, a vulnerability categorized as CWE-770 . While the stack validates stream-level limits, it neglects connection-level limits, allowing a remote peer to send more bytes than permitted by the connection window as long...

CVE-2026-75804 QUIC Connection-Level Flow Control is Not Enforced for Streams

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-75804 QUIC Connection-Level Flow Control is Not Enforced for Streams

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-75804 QUIC Connection-Level Flow Control is Not Enforced for Streams

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

CVE-2026-75804

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

EUVD-2026-89006

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...

CVE-2026-54875 Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...

CVE-2026-54875

OpenSSL versions 4.0, 3.6, 3.5, and 3.4 are vulnerable to a timing and cache side-channel on ARM64 and RISC-V platforms. The root cause is a non-constant-time optimized implementation of scalar point multiplication for SM2 private key operations, where execution time and cache-access patterns dep...

CVE-2026-54875 Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V

Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption ...