Skip to content
OpenAdvisories
High ELSA-2026-85968 2 CVEs

Important: openssl security update (Oracle Linux 8)

Published Oct 20, 2026 · Updated Oct 20, 2026

Ecosystem: Oracle Linux

Summary

[1:1.1.1k-18]
- Fix CVE-2026-63072: heap buffer overflow in CMS key unwrapping
Resolves: RHEL-246295
- Fix CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset
Resolves: RHEL-264420

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 8 openssl 1:1.1.1k-18.el8_6
Oracle Linux · 8 openssl-devel 1:1.1.1k-18.el8_6
Oracle Linux · 8 openssl-libs 1:1.1.1k-18.el8_6
Oracle Linux · 8 openssl-perl 1:1.1.1k-18.el8_6

Vulnerabilities 2

  • High 8.2
    CVE-2026-84782

    DTLS Retransmits Handshake Messages From a Stale Buffer Offset

    Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspend…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-63072 Public exploit

    Heap Buffer Overflow in CMS Key Unwrapping

    Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impa…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi