Reported by 11 outlets
High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL
Why this score
- Breadth
- 2.00 / 2.0 · 11 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 3.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.48 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
The OpenSSL advisory of 29 September 2026 fixes 14 vulnerabilities, with CVE-2026-84782 (CVSS 8.2, out-of-bounds read) the standout. The bug sits in DTLS handshake retransmission: when a handshake message write suspends because the transport cannot accept more data, the retransmission timer can fire and reuse the same internal buffer without resetting the read position. The retransmitted message starts at the stale offset where the suspended write stopped, sending leftover heap data from another handshake message as plaintext DTLS content, and can read past the allocation to leak heap memory to the remote peer or crash the process. Affected branches are 4.0 before 4.0.3, 3.6 before 3.6.5, 3.5 before 3.5.9, 3.4 before 3.4.8, and the premium-only 3.0 before 3.0.23, 1.1.1 before 1.1.1zj and 1.0.2 before 1.0.2zs. A second tracked issue, CVE-2026-84783, is a medium-severity use-after-free in the X.509 extension cache that can crash a multi-threaded TLS client when concurrent connections build chains to the same trusted CA. WolfSSL shipped a parallel patch cycle for roughly a dozen flaws, so this is not a single-vendor event.
A remote, unauthenticated peer can trigger CVE-2026-84782 over the network without user interaction, which makes it an immediate patch target. DTLS is embedded in VPN endpoints, VoIP gateways and IoT management interfaces, so exposure goes well beyond web servers. Coverage on r/cybersecurity the same day confirms broad defender attention, but the event record shows no confirmed in-the-wild exploitation as of 30 September 2026. That absence is not a reason to delay: the flaw is remotely reachable, needs no authentication, and lives in long-term support branches that power appliances and embedded gear with slow update paths.
Defenders should move to 4.0.3, 3.6.5, 3.5.9 or 3.4.8 as appropriate, with premium customers also covering 3.0.23, 1.1.1zj and 1.0.2zs, and verify that DTLS-enabled services are actually covered since TLS-only hosts are not directly vulnerable but may share the library. Hunt at the network edge for DTLS handshake anomalies and unexpected plaintext fragments in DTLS traffic; the advisories give no file-based indicators, so target retransmission patterns. Watch downstream appliance vendors that bundle OpenSSL, whose patch cycles lag upstream, and watch for any shift from no exploitation reports to confirmed activity once exploit details circulate.
Timeline
-
original reporting
High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL
securityweek.com · 13d ago · September 30th, 2026
The developers of the OpenSSL and WolfSSL open source cryptographic libraries announced patches for roughly a dozen vulnerabilities each, including high-severity flaws. Of the 14 vulnerabilities fixed in OpenSSL , one has been assigned a high severity rating. Tracked as CVE-2026-84782, it could allow a remote peer to obtain fragments of heap memory or crash applications that use Datagram TLS (DTLS), a protocol commonly found in VPNs, VoIP and IoT products. The flaw is triggered during the DTLS handshake, when OpenSSL retransmits a message while sending another one is stalled. This can cause leftover heap data to be sent to the other party in plaintext. If the read reaches unmapped memory, the application crashes, resulting in a denial-of-service (DoS) condition. The issue has a CVSS score of 8.2 and can be exploited over the network without authentication or user interaction. The latest OpenSSL releases also fix a medium-severity vulnerability identified as CVE-2026-84783. A remote, unauthenticated peer could exploit the weakness to crash a multi-threaded TLS client and cause a DoS condition. The remaining security holes have a low severity rating. They mostly lead to DoS conditions, caused by excessive memory or CPU consumption, process crashes, or the termination of DTLS 1.2 connections. The rest could let attackers abuse QUIC servers for DDoS amplification or exploit timing side channels to gather information that could lead to private key recovery. Advertisement. Scroll t
-
update from malware.news
wolfSSL security advisory (AV26-969)
malware.news · 15d ago · September 28th, 2026
Serial Number: AV26-969 Date: September 28, 2026 As of September 25, 2026, wolfSSL is affected by vulnerabilities in the following product: wolfSSL Prior to or equal to 5.9.4 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
-
update from openssl-library.org
OpenSSL Security Advisory [29th September 2026] - DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782)
openssl-library.org · 15d ago · September 29th, 2026
The OpenSSL vendor advisory dated 29 September 2026 details 14 fixed vulnerabilities including the high-severity CVE-2026-84782 (CWE-125 out-of-bounds read, CVSS 8.2) in DTLS handshake retransmission. It confirms affected versions (4.0 before 4.0.3, 3.6 before 3.6.5, 3.5 before 3.5.9, 3.4 before 3.4.8, 3.0 before 3.0.23, 1.1.1 before 1.1.1zj, 1.0.2 before 1.0.2zs) and provides exact upgrade targets. The issue was reported by Laurent Gaffie (secorizon.com) on 17 August 2026; fix developed by Ryan Hooper. The advisory also covers CVE-2026-84783 (moderate use-after-free in X.509 extension cache under concurrent use, reported 27 August 2026 by Tim Becker and independently 31 August 2026 by aydinmercan), plus low-severity issues in QUIC amplification, CPU DoS, timing side-channels, and SM2 scalar multiplication.
-
update from cve.org
CVE-2026-84782 - CVE Record (CNA: OpenSSL Software Foundation)
cve.org · 15d ago · September 29th, 2026
Published 29 September 2026 and updated the same day by the OpenSSL Software Foundation. Credits reporter Laurent Gaffie (secorizon.com) and remediation developer Ryan Hooper. References the vendor advisory at https://openssl-library.org/news/secadv/20260929.txt and GitHub commit links for the fixes.
-
update from ubuntu.com
USN-8847-1: OpenSSL vulnerabilities - Ubuntu Security Notice
ubuntu.com · 15d ago · September 29th, 2026
Ubuntu published USN-8847-1 on 29 September 2026 covering the OpenSSL patch set. It lists CVE-2026-84782 (DTLS retransmission, DoS / sensitive info disclosure), CVE-2026-35189 (excessive memory from CRLDP), CVE-2026-35191 (QUIC amplification), CVE-2026-54872 (non-NIST EC timing side-channel), CVE-2026-54875 (SM2 scalar multiplication on ARM64/RISC-V), CVE-2026-72897 (SSL context switch out-of-bounds read), CVE-2026-75804 (QUIC flow control), CVE-2026-75805 (NULL pointer in CMP revocation), CVE-2026-75806 (DTLS 1.2 AEAD undersized record DoS), CVE-2026-77696 (SM2 timing), and CVE-2026-84784 (QUIC RETIRE_CONNECTION_ID backlog). Fix versions for Ubuntu releases are specified (e.g., 3.5.5-1ubuntu3.6 for 26.04 LTS, 3.0.13-0ubuntu3.16 for 24.04 LTS, 3.0.2-0ubuntu1.30 for 22.04 LTS).
-
update from gbhackers.com
OpenSSL High-Severity Flaw Lets Attackers Leak Heap Memory in Plaintext
gbhackers.com · 13d ago · September 30th, 2026
The issue affects various […] The post OpenSSL High-Severity Flaw Lets Attackers Leak Heap Memory in Plaintext appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
OpenSSL Patches 14 Security Flaws Including High-Severity Memory Disclosure Bug
cyberpress.org · 13d ago · September 30th, 2026
The flaw occurs when a DTLS handshake message write is suspended because the underlying transport cannot accept additional data, while the retransmission timer simultaneously attempts to resend a previously queued handshake message. OpenSSL Patches 14 Security Flaws OpenSSL’s retransmission code reused buffer and position-tracking data associated with the handshake message that was still being written. Instead of resetting the retransmitted message’s read position to its beginning, the operation could start at the offset where the suspended write stopped. In certain circumstances, the operation could read beyond the allocated message buffer, exposing heap-resident data to the remote peer. OpenSSL said the patch resets the retransmission cur
-
mentioned by linuxforeducation.blogspot.com
OpenSSL 4.0.3 released: includes security fixes for high-severity vulnerabilities
linuxforeducation.blogspot.com · 13d ago · September 30th, 2026
-
update from securityweek.com
High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL
securityweek.com · 13d ago · September 30th, 2026
submitted by /u/NISMO1968 [link] [comments]
via reddit r/cybersecurity: High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL
-
mentioned by cybersecurefox.com
CVE-2026-84782: DTLS heap memory leak in OpenSSL 🔗 https:// cybersecurefox.com/en/cve-2026 -84782-openssl-dtls-heap-memory-leak # CVE -2026-
cybersecurefox.com · 8d ago · October 5th, 2026
-
mentioned by meterpreter.org
Discover how the OpenSSL DTLS memory leak (CVE-2026-84782) allows out-of-bounds reads and denial-of-service attacks. Learn about the patch a
meterpreter.org · 8d ago · October 5th, 2026
-
update from capturedtech.com
New on CapturedTech: OpenSSL 4.0.3 DTLS Heap Memory Leak — the CVE-2026-84782 fix, explained. What broke, how the patch fixes it, and how to
capturedtech.com · 3d ago · October 10th, 2026
What broke, how the patch fixes it, and how to
via Mastodon https://capturedtech.com/Home/Post/8898