Skip to content
OpenAdvisories
High RLSA-2026:67154 9 CVEs

Important: openssl security, bug fix, and enhancement update

Published Sep 15, 2026 · Updated Sep 15, 2026

Ecosystem: Rocky Linux

Summary

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

* openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456)

* openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798)

* openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)

* openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076)

* openssl: RPK server signature algorithm selection can dereference a missing certificate (CVE-2026-14457)

* openssl: excessive memory use buffering DTLS records for a future epoch (CVE-2026-54874)

* openssl: untrusted sender DN used as format string in CMP response validation (CVE-2026-63073)

* openssl: CMP indefinite cache growth of ExtraCerts (CVE-2026-63074)

* openssl: QUIC ACK-only packet retention can cause memory exhaustion (CVE-2026-63075)

Bug Fix(es) and Enhancement(s):

* openssl: HollowByte remote memory-exhaustion DoS fix may be missing [Rocky Linux 10.2.z] (JIRA:Rocky Linux-212362)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 10 openssl 1:3.5.8-1.el10_2

Vulnerabilities 9

  • Critical 9.8
    CVE-2026-63073

    Untrusted Sender DN Used as Format String in CMP Response Validation

    Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expecte…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-14456

    Unbounded Memory Growth in QUIC Server Incoming Channel Queue

    Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can m…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • High 7.5
    CVE-2026-14457

    RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate

    Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys an…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • High 7.5
    CVE-2026-18798

    QUIC Server May Trigger Double Free When Processing INITIAL Packet

    Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi
  • High 7.5
    CVE-2026-54874

    Excessive Memory Use Buffering DTLS Records for a Future Epoch

    Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpo…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-63072 Public exploit

    Heap Buffer Overflow in CMS Key Unwrapping

    Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impa…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-63075

    QUIC ACK-only Packet Retention Can Cause Memory Exhaustion

    Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A rem…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-63076

    Invalid Pointer Dereference in CMP Server via Crafted protectionAlg

    Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which i…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2026-63074

    CMP Indefinite Cache Growth of ExtraCerts

    Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraC…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2515348
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517559
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517560
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517561
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517562
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517564
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517565
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517566
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517570
  • advisory
    https://access.redhat.com/errata/RHSA-2026:67154