Critical Vulnerability in OpenSSL: DTLS Retransmits Handshake Messages from Stale Buffer Offset
Summary
RLSA-2026:77396: Important: openssl security update. Affects openssl versions < 1:3.5.8-2.el9_8. Fixed in 1:3.5.8-2.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely-used toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, providing essential cryptographic functionalities for secure communications over networks. It is integral to many applications and services, ensuring data integrity and confidentiality. The vulnerability in question affects OpenSSL's handling of Datagram Transport Layer Security (DTLS) handshake messages, potentially leading to security breaches.
Vulnerability Detail
The vulnerability, identified as CVE-2026-84782, arises from OpenSSL's compatibility layer mishandling DTLS retransmissions. Specifically, it allows the retransmission of handshake messages from a stale buffer offset, which could be exploited by an attacker to manipulate the handshake process. This could lead to unauthorized access or data interception, posing significant risks to the confidentiality and integrity of communications.
How To Fix
Minimum fixed version
1:3.5.8-2.el9_8
This is the first release that contains the fix.
sudo dnf update opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of their OpenSSL implementation by disabling DTLS if it is not required for their applications. This can be done by modifying the application configuration to avoid using DTLS features until the update is applied.
Conclusion
The OpenSSL vulnerability CVE-2026-84782 poses a significant risk due to its potential to allow unauthorized access through improper handling of DTLS handshake messages. It is crucial for users to update their OpenSSL installations to the latest patched version to safeguard their systems. Temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for openssl →
FAQ
CVE-2026-84782 is a security vulnerability in OpenSSL that allows DTLS handshake messages to be retransmitted from a stale buffer offset, potentially leading to unauthorized access.
The CVSS score for this vulnerability is 7.4, indicating a high severity level that could significantly impact the security of affected systems.
The vulnerability affects OpenSSL versions prior to 1:3.5.8-2.el9_8, particularly in Rocky Linux 9 environments.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without any signup.
If an immediate update is not possible, consider disabling DTLS in your application as a temporary workaround to reduce exposure to the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
