OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory Unencrypted
Summary: OpenSSL disclosed a High-severity DTLS flaw, CVE-2026-84782, on September 29 that can leak heap memory to the other side of a DTLS connection as unencrypted handshake data or crash the program when a resend timer fires while a larger handshake message is paused mid-send. Fixes are in OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8, while fixes for the 3.0, 1.1.1 and 1.0.2 branches go only to premium support customers; Laurent Gaffie of Secorizon reported the flaw on August 17 and Ryan Hooper developed the fix.
What's compelling: OpenSSL lists no workaround, and anyone who builds OpenSSL 3.0 or ships a copy inside their own software has no public fix at all, since 3.0 stopped getting public security fixes on September 7 and 3.0.23 is the first 3.0 security release OpenSSL has not made public.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-84782CVE-2026-84783
- Related
- ⚡ Weekly Recap: Net Scaler and Forti Mail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026