Reported by 3 outlets

Timeline

1. original reporting

   OpenSSL security advisory (AV26-846)

   malware.news · 49d ago · August 25th, 2026

   Serial Number: AV26-846 Date: August 25, 2026 As of August 25, 2026, OpenSSL is affected by vulnerabilities in the following product: OpenSSL Prior to 1.0.2zr Prior to 1.1.1zi Prior to 3.0.22 Prior to 3.4.7 Prior to 3.5.8 Prior to 3.6.4 Prior to 4.0.2 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Vulnerabilities | OpenSSL Library Article Link: OpenSSL security advisory (AV26-846) - Canadian Centre for Cyber Security

2. update from gbhackers.com

   OpenSSL Flaws Allow Remote Attackers to Crash Servers With Malformed Packets

   gbhackers.com · 48d ago · August 26th, 2026

   OpenSSL has released security updates addressing nine vulnerabilities that could allow remote attackers to crash QUIC, DTLS, CMS, CMP, and TLS-enabled applications through malformed network packets or cryptographic messages. The advisory dated August 25, 2026, highlights three moderate-severity issues and six low-severity flaws. Most of these problems could lead to denial-of-service (DoS) conditions due to […] The post OpenSSL Flaws Allow Remote Attackers to Crash Servers With Malformed Packets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from cyberpress.org

   OpenSSL Patches Nine Vulnerabilities Enabling Remote Denial-of-Service Attacks

   cyberpress.org · 48d ago · August 26th, 2026

   OpenSSL has released security updates to address nine vulnerabilities across its QUIC, CMS, Certificate Management Protocol (CMP) , DTLS, TLS Raw Public Key (RPK), and AEAD code paths. The 25 August 2026 advisory contains three Moderate-severity and six Low-severity flaws, several of which allow a remote attacker or malicious peer to crash affected applications or exhaust their memory. The most serious issue, CVE-2026-18798, is a double-free vulnerability in the QUIC server stack. A malformed, non-RFC 9000-compliant QUIC INITIAL packet with a Destination Connection ID shorter than eight bytes can force channel creation to fail. OpenSSL Patches Nine Vulnerabilities OpenSSL then frees the same QRX receive object twice, corrupting the heap and typically terminating the server process. The advisory says remote code execution is highly improbable, but the flaw can be induced with relatively low effort. CVE-2026-63072 affects CMS_decrypt() and can produce a deterministic eight-byte out-of-bounds heap write during CMS key unwrapping. An attacker can modify a key-wrap object identifier in an otherwise legitimate CMS message to select AES-WRAP-PAD. Although integrity verification subsequently fails, the primitive may write and cleanse more data than the allocation allows, resulting in heap corruption and a denial of service . OpenSSL also fixed CMP flaws that affect explicitly enabled deployments. CVE-2026-63076 lets a crafted protectionAlg parameter trigger an invalid-pointer derefer