Critical Vulnerability in OpenSSL: Denial of Service and Memory Exploits
Summary
RLSA-2026:67165: Important: openssl security, bug fix, and enhancement update. Affects openssl versions < 1:3.5.8-1.el9_8. Fixed in 1:3.5.8-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely-used toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, along with a comprehensive cryptography library. It is essential for securing communications over networks. However, recent vulnerabilities have been identified that could lead to severe security risks, including Denial of Service (DoS) attacks and memory corruption issues.
Vulnerability Detail
The vulnerabilities in OpenSSL stem from various issues, including unbounded memory growth in the QUIC server, which can lead to Denial of Service (CVE-2026-14456). Additionally, a double free error when processing INITIAL packets (CVE-2026-18798) and a heap buffer overflow during CMS key unwrapping (CVE-2026-63072) pose significant risks. Other vulnerabilities include invalid pointer dereferences and excessive memory use, which can lead to memory exhaustion. These vulnerabilities can be exploited by attackers to crash services or gain unauthorized access to sensitive data.
How To Fix
Minimum fixed version
1:3.5.8-1.el9_8
This is the first release that contains the fix.
sudo dnf update opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the memory usage of the QUIC server by configuring appropriate memory limits in your server settings. However, this is not a permanent solution and updating to the patched version is strongly advised.
Conclusion
The vulnerabilities in OpenSSL present significant risks that can lead to Denial of Service attacks and memory corruption. It is crucial to update to the latest patched version to ensure the security of your systems. Regular monitoring and using tools like Vulert can help in identifying and mitigating such vulnerabilities effectively.
See every vulnerability recorded for openssl →
FAQ
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
The main vulnerabilities include Denial of Service via unbounded memory growth, double free errors, heap buffer overflows, and invalid pointer dereferences.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, these vulnerabilities can potentially lead to data loss or unauthorized access if exploited by attackers.
If you cannot update immediately, consider implementing memory usage limits and monitoring your systems closely for any unusual activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
