PT-2026-102653

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A TLS server may experience an out-of-bounds read and a fixed-value out-of-bounds write on the server heap when calling the SSL set SSL CTX function to switch a connection to a different SSL...

PT-2026-102655

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A CMP client that requests certificate revocation using a PKCS10 CSR may experience a NULL pointer dereference when processing a specially crafted revocation response from a server. This occu...

OpenSSL Security Advisory 20260929

OpenSSL Security Advisory 20260929 - The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs t...

FreeBSD Security Advisory - FreeBSD-SA-26:68.openssl

FreeBSD Security Advisory - Out-of-bounds read in OpenSSL DTLS retransmission. The retransmitted message may include heap memory contents, disclosing them to the DTLS peer as plaintext handshake data. If the read reaches unmapped memory, the application crashes, resulting in a Denial of Service D...

Linux Distros Unpatched Vulnerability : CVE-2026-75804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the...

Linux Distros Unpatched Vulnerability : CVE-2026-42772

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic...

Linux Distros Unpatched Vulnerability : CVE-2026-35189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions...

PT-2026-102647

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description Processing a certificate containing numerous nameRelativeToCRLIssuer CRL distribution points can cause disproportionate heap growth when X.509 extensions are cached. A malicious peer can send...

CVE-2026-84783: Use After Free

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server...

Linux Distros Unpatched Vulnerability : CVE-2026-84783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is...

Linux Distros Unpatched Vulnerability : CVE-2026-54875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms...

Linux Distros Unpatched Vulnerability : CVE-2026-35191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its...

OpenSSL -- Multiple vulnerabilities

The OpenSSL project reports: DTLS Retransmits Handshake Messages From a Stale Buffer Offset CVE-2026-84782 High Use-After-Free in X.509 Extension Cache Under Concurrent Use CVE-2026-84783 Moderate Excessive Memory Allocation in Relative CRLDP Processing CVE-2026-35189 Low QUIC Unvalidated...

FreeBSD-SA-26:68.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:68.openssl Security Advisory The FreeBSD Project Topic: Out-of-bounds read in OpenSSL DTLS retransmission Category: contrib Module: openssl Announced:...

Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2026-3096)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3096 advisory. A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and...

Excessive Memory Allocation in Relative CRLDP Processing

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...

Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...

NULL Pointer Dereference in CMP Client Revocation Response Handling

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial o...

QUIC Connection-Level Flow Control is Not Enforced for Streams

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

QUIC Unvalidated Amplification Credit may be Over Accounted

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data...