Summary
It was discovered that OpenSSL incorrectly handled certain certificate
revocation list distribution point names. An attacker could possibly use
this issue to cause OpenSSL to consume excessive memory, resulting in a
denial of service. (CVE-2026-35189)
It was discovered that OpenSSL incorrectly handled QUIC unvalidated
amplification credit accounting. An attacker could possibly use this
issue to cause a denial of service. This issue only affected
Ubuntu 26.04 LTS. (CVE-2026-35191)
It was discovered that OpenSSL incorrectly implemented scalar
multiplication for non-NIST elliptic curves. An attacker could possibly
use this issue to perform a timing side-channel attack and obtain
sensitive information. (CVE-2026-54872)
It was discovered that OpenSSL incorrectly implemented SM2 scalar
multiplication on ARM64 and RISC-V architectures. An attacker could
possibly use this issue to perform a timing side-channel attack and
obtain sensitive information. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-54875)
It was discovered that OpenSSL incorrectly handled SSL context switching
during a TLS handshake. An attacker could possibly use this issue to
cause an out-of-bounds read, resulting in a denial of service or
obtaining sensitive information. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-72897)
It was discovered that OpenSSL incorrectly enforced QUIC connection-
level flow control for streams. An attacker could possibly use this
issue to cause OpenSSL to consume excessive memory, resulting in a
denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-75804)
It was discovered that OpenSSL incorrectly handled a NULL pointer in
CMP client revocation response processing. An attacker could possibly
use this issue to cause a denial of service. (CVE-2026-75805)
It was discovered that OpenSSL incorrectly handled undersized DTLS 1.2
AEAD records before authentication. An attacker could possibly use this
issue to cause a denial of service. (CVE-2026-75806)
It was discovered that OpenSSL incorrectly implemented SM2 signature
generation. An attacker could possibly use this issue to perform a
timing side-channel attack and obtain sensitive information.
(CVE-2026-77696)
It was discovered that OpenSSL incorrectly handled DTLS retransmission
of handshake messages. An attacker could possibly use this issue to
cause incorrect handshake behavior or a denial of service.
(CVE-2026-84782)
It was discovered that OpenSSL incorrectly handled QUIC
RETIRE_CONNECTION_ID frames. An attacker could possibly use this issue
to cause OpenSSL to consume excessive memory, resulting in a denial of
service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-84784)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | openssl | 3.0.2-0ubuntu1.30 |
| Ubuntu · 24.04 LTS 24.04:LTS | openssl | 3.0.13-0ubuntu3.16 |
| Ubuntu · 26.04 LTS 26.04:LTS | openssl | 3.5.5-1ubuntu3.6 |
Vulnerabilities 11
-
High 8.2
DTLS Retransmits Handshake Messages From a Stale Buffer Offset
Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspend…
-
High 7.5
Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake
Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms…
-
High 7.5
QUIC: Unbounded RETIRE_CONNECTION_ID Backlog
Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every…
-
Medium 5.3
Excessive Memory Allocation in Relative CRLDP Processing
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memo…
-
Medium 5.3
QUIC Connection-Level Flow Control is Not Enforced for Streams
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connectio…
-
Medium 5.3
NULL Pointer Dereference in CMP Client Revocation Response Handling
Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a rea…
-
Medium 5.3
Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS
Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacke…
-
Low 3.7
QUIC Unvalidated Amplification Credit may be Over Accounted
Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplificatio…
-
Low 3.7
Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves
Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to me…
-
Low 3.7
Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V
Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access…
-
Low 3.7
Timing Side-Channel in SM2 Signature Generation
Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over man…
References
-
report
https://ubuntu.com/security/CVE-2026-35189
-
report
https://ubuntu.com/security/CVE-2026-35191
-
report
https://ubuntu.com/security/CVE-2026-54872
-
report
https://ubuntu.com/security/CVE-2026-54875
-
report
https://ubuntu.com/security/CVE-2026-72897
-
report
https://ubuntu.com/security/CVE-2026-75804
-
report
https://ubuntu.com/security/CVE-2026-75805
-
report
https://ubuntu.com/security/CVE-2026-75806
-
report
https://ubuntu.com/security/CVE-2026-77696
-
report
https://ubuntu.com/security/CVE-2026-84782
-
report
https://ubuntu.com/security/CVE-2026-84784