OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8 Fix 14 CVEs, One High in DTLS

OpenSSL Lines, Fixed Releases and Affected CVEs #

Every supported line got a release on September 29, and each fixes only the CVEs that reach that line. OpenSSL 3.0, 1.1.1 and 1.0.2 receive fixes only through premium support. The advisory adds that 3.1, 3.2 and 3.3 are out of support and were not analysed.

Scanners may rate several of these higher than OpenSSL does. CISA-ADP added CVSS 3.1 scores to the CVE records: 8.2 for the High DTLS bug, and 7.5, also High, for the Moderate X.509 use-after-free and for three CVEs OpenSSL rates Low, CVE-2026-54873, CVE-2026-72897 and CVE-2026-84784. CISA's SSVC assessments rate exploitation of all 14 as none.

CVE-2026-84782: DTLS Retransmission From a Stale Buffer Offset #

A DTLS handshake message can be written in several fragments, and the write can pause with WANT_WRITE when the transport cannot take more data. If the retransmission timer fires during that pause, OpenSSL resent an earlier message from the buffer position where the paused write had stopped, not from its start. The resent message could carry leftover bytes from the larger message still in flight and read past the end of the buffer. The peer then receives heap memory as plaintext handshake data, or the process crashes when the read reaches unmapped memory.

It affects every line from 1.0.2 to 4.0, and only applications that use DTLS. The fix restarts the retransmission at the beginning of the message and skips retransmission while a handshake write is paused. Laurent Gaffie of secorizon.com reported it on 17 August 2026, and Ryan Hooper developed the fix.

CVE-2026-84783: X.509 Extension Cache Use-After-Free on 4.0 Only #

OpenSSL caches decoded X.509v3 extensions inside a certificate the first time they are needed. In 4.0 the cache is computed under a read lock and installed under a write lock, so several threads can build it at once and each one frees the values the previous thread installed while another caller may still use them. In TLS the exposed certificates are the trusted CA certificates, which every connection shares. A multi-threaded TLS client, or a multi-threaded server that requests client certificates, can crash when several connections build their first chains to the same CA at the same time. The advisory states that 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected, so 3.x users need no action for this CVE. Tim Becker of Xint.io reported it, and aydinmercan published it independently.

Five QUIC Denial-of-Service Flaws #

These affect only applications that use OpenSSL's own QUIC stack, on 4.0, 3.6, 3.5 and, except for the first, 3.4:

• CVE-2026-35191: a QUIC server that does not validate client addresses counts a multi-packet datagram once per packet, so it can exceed the RFC 9000 limit of three times the received data and be used to amplify a DDoS attack. 3.4 is not affected.
• CVE-2026-42772: out-of-order STREAM frames force a quadratic search in stream reassembly, so a peer that completes the handshake can cause CPU pressure with little bandwidth.
• CVE-2026-54873: stream data stays in packet buffers until the application reads it, so a peer can keep far more memory allocated than the data needs; OpenSSL now copies the data once a stream's overhead passes 64 kB.
• CVE-2026-75804: connection-level flow control was not enforced for streams, so a peer can make the stack receive about 100 MB instead of the default 768 KiB window.
• CVE-2026-84784: a flood of NEW_CONNECTION_ID frames with withheld ACKs makes the stack queue a RETIRE_CONNECTION_ID frame for each, up to about 400 MB.

Timing Side Channels in Non-NIST and SM2 Signing #

CVE-2026-54872 affects ECDSA and SM2 signing on curves without a dedicated constant-time implementation, such as Brainpool. The time taken depends on the per-signature nonce, and over many measured signatures a lattice attack can recover the private key. The leak is very small and largest for curves whose group order lies on a machine-word boundary, such as brainpoolP384r1. The NIST curves P-256, P-384 and P-521 are not affected. Alicja Kario and George Pantelakis of Red Hat found it in a Minerva-style analysis based on a report by Youngjae Choi of Korea University.

CVE-2026-54875 concerns SM2 signing and decryption on ARM64 and RISC-V, where an optimized scalar multiplication branches on bits of the secret, and it affects 4.0 to 3.4. CVE-2026-77696 is a timing side channel in SM2 signature generation on every line from 1.1.1 to 4.0.

Certificate Memory, SSL_CTX Switching, CMP and DTLS 1.2 #

• CVE-2026-35189: a certificate chain under the roughly 100 KiB peer limit, with many nameRelativeToCRLIssuer CRL distribution points, can make the receiver allocate several hundred MiB during a normal handshake. It affects clients and servers that request client certificates, on every line.
• CVE-2026-72897: a TLS server that calls SSL_set_SSL_CTX() mid-handshake, usually from a servername callback for virtual hosts, can read and in some cases write past an internal array when the new context knows more provider signature algorithms. Applications that never call it are not affected.
• CVE-2026-75805: a CMP client that requests revocation based on a PKCS#10 CSR crashes on a crafted revocation response, on 3.0 and later.
• CVE-2026-75806: one unauthenticated datagram shorter than the explicit IV and tag tears down an established DTLS 1.2 association that uses an AEAD cipher suite, on 1.1.1 and later.

Two fixes in the same releases carry no CVE. 4.0.3, 3.6.5 and 3.5.9 fix EVP_DecryptFinal() reporting a stale success after an AES-SIV authentication failure, which matters to code that relies on that return value. 4.0.3 also fixes a 4.0 regression in which the base64 encoding BIO could lose encoded data on incomplete writes.

OpenSSL 4.1.0, the New Feature Line #

OpenSSL 4.1.0 followed on October 23 as a feature release with DTLS 1.3, RFC 8701 GREASE, DTLS support in the SSL listener API and the IKEV2 KDF. Its notes list four known DTLS issues, among them DTLS 1.3 records dropped from the retransmission buffer after a KeyUpdate. It drops the no-ecdsa and no-ecdh Configure options and the Itanium and Windows CE targets, and tsget now needs Net::Curl::Easy. For a fix to the September CVEs, the patch release on the installed line is the smaller change.

Updating OpenSSL and the Software That Bundles It #

1. Install 4.0.3, 3.6.5, 3.5.9 or 3.4.8 for the line in use, or the distribution package that carries the backport, then restart every process that loaded the old library.
2. Rebuild statically linked binaries and container images, and update runtimes that ship their own OpenSSL, such as Node.js or Python builds, because a system update does not reach their copy.
3. Give DTLS services priority, since they are the only ones exposed to the High CVE; QUIC services on 3.4 and later come next.
4. On 3.0, 1.1.1 or 1.0.2 without premium support, move to a supported line or to a vendor build with backports; on 3.1 to 3.3, which OpenSSL did not analyse, do the same.
5. Where Brainpool or SM2 keys sign many messages for untrusted parties, update before those keys sign more, and consider rotating keys used heavily before the fix.

Checking Which OpenSSL a System and Its Runtimes Use #

The system library, a server binary and each runtime can each use a different OpenSSL, so each needs its own check. The last command shows whether an application links DTLS or QUIC functions.

openssl version -a
ldd "$(command -v nginx)" | grep -E "libssl|libcrypto"
python3 -c "import ssl; print(ssl.OPENSSL_VERSION)"
node -p "process.versions.openssl"
nm -D --undefined-only /path/to/binary | grep -E "DTLS|OSSL_QUIC|SSL_set_SSL_CTX"