OESA-2026-3830 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated...

CVE-2026-57497 webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A...

CVE-2026-90678

A flaw was found in HAProxy. A remote, unauthenticated attacker can exploit a vulnerability in the HTTP/3 multiplexer when processing requests without a Content-Length header, leading to HTTP request smuggling. This occurs when HAProxy is configured with QUIC support and an HTTP/3 frontend, and...

Important: Red Hat Security Advisory: openssl security, bug fix, and enhancement update

An update for openssl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

openssl: QUIC server may trigger double free when processing INITIAL packet

A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID destination connection ID can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service...

openssl: QUIC ACK-only packet retention can cause memory exhaustion

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory...

openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server

A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption...

openssl: QUIC ACK-only packet retention can cause memory exhaustion

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory...

openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server

A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption...

Important: Red Hat Security Advisory: openssl security, bug fix, and enhancement update

An update for openssl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

openssl: QUIC server may trigger double free when processing INITIAL packet

A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID destination connection ID can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service...

RHEL 10 : openssl (RHSA-2026:67154)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67154 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

Important: openssl security, bug fix, and enhancement update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-14456 openssl: QUI...

RHEL 9 : openssl (RHSA-2026:67165)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67165 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

Important: openssl

Issue Overview: Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically...

ALSA-2026:67154 Important: openssl security, bug fix, and enhancement update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-14456 openssl: QUI...

ALSA-2026:67165 Important: openssl security, bug fix, and enhancement update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-14456 openssl: QUI...

CVE-2026-90678

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...

UBUNTU-CVE-2026-90678

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...

CVE-2026-90678

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...