This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] OpenSSL fixes 14 vulnerabilities

OpenSSL versions 3.4.8, 3.5.9, 3.6.5, 4.0.3 [1] (for customers with premium support also 1.0.2zs, 1.1.1zj, 3.0.23) fix 14 vulnerabilities [2]. The most severe of them are described below. Fixed versions of the library [1]: OpenSSL - 3.4.8, 3.5.9, 3.6.5, 4.0.3 OpenSSL (premium support) - 1.0.2zs, 1.1.1zj, 3.0.23, 3.4.8, 3.5.9, 3.6.5, 4.0.3 Debian releases and their fixed versions [3]: trixie (security) - 3.5.7-1~deb13u3 sid - 3.6.5-1 Ubuntu releases and their fixed versions [4][5][6]: 26.04 LTS resolute - libssl3t64 – 3.5.5-1ubuntu3.7 24.04 LTS noble - libssl3t64 – 3.0.13-0ubuntu3.16 22.04 LTS jammy - libssl3 – 3.0.2-0ubuntu1.30

OpenSSL - DoS (CVE-2026-84782)
CVSS 8.2 (High)

An unauthenticated remote attacker who is the peer of a DTLS connection can obtain heap memory contents sent in an unencrypted handshake message or perform a DoS attack. The vulnerability is exploitable if, during a DTLS handshake, the message retransmission timer expires at a moment when writing another handshake message is paused because the transport layer is temporarily not accepting data (WANT_WRITE) [2].

The vulnerability is present in product:

  • OpenSSL;>=1.0.2, <1.0.2zs;>=1.1.1, <1.1.1zj;>=3.0, <3.0.23;>=3.4, <3.4.8;>=3.5, <3.5.9;>=3.6, <3.6.5;>=4.0, <4.0.3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

More information:

The vulnerability was publicly disclosed 29. 9. 2026.

OpenSSL - DoS (CVE-2026-84783)
CVSS 7.5 (High)

An unauthenticated remote attacker can, due to a Use-After-Free vulnerability in the X.509 certificate extension cache, perform a DoS attack against a multithreaded TLS client or server that requires client certificates, provided that the first chains to the same trusted certificate authority are being built by several connections simultaneously [2].

The vulnerability is present in product:

  • OpenSSL;>=4.0, <4.0.3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 29. 9. 2026.

By CESNET, z.s.p.o. Táňa Macháčková on 30. 9. 2026.

CESNET, z.s.p.o. Logo