OpenSSL has released a new security advisory detailing seven vulnerabilities in its cryptographic library. These issues range from a heap corruption bug to memory exhaustion vulnerabilities affecting its QUIC and DTLS implementations.
Impact on Popular OpenSSL Versions
The discovered vulnerabilities affect popular OpenSSL branches, including versions 4.0, 3.6, 3.5, 3.4, and 3.0. Some issues also extend to the older 1.1.1 line, making it crucial for organizations utilizing TLS, CMS, or CMP services to promptly apply patches.
The most critical flaw, identified as CVE-2026-63072 and rated as Moderate, is found in OpenSSL’s CMS decryption code. It arises from a mismatch in expected and actual output buffer sizes during key unwrapping, potentially allowing attackers to perform an 8-byte out-of-bounds heap write.
Details of Other Identified Flaws
Another Moderate-severity flaw, CVE-2026-63076, impacts the Certificate Management Protocol (CMP). This flaw is due to inadequate verification of a protection algorithm parameter, leading to the possibility of an invalid pointer dereference.
Several Low-severity vulnerabilities include CVE-2026-14457, which causes a null pointer dereference in TLS configurations using Raw Public Keys without certificates. Other issues involve excessive memory usage in DTLS (CVE-2026-54874) and untrusted sender validation in CMP responses (CVE-2026-63073).
Security Recommendations
OpenSSL has released patched versions for all affected branches: 4.0.2, 3.6.4, 3.5.8, 3.4.7, and 3.0.22. Additionally, premium support customers using versions 1.1.1 and 1.0.2 have received specific backports.
Given the widespread impact and the potential for remote exploitation, it is imperative for security teams to inventory their OpenSSL deployments. Immediate application of the relevant patches is advised to secure systems against potential attacks.
By prioritizing updates, organizations can mitigate risks associated with these vulnerabilities, ensuring the continued security and functionality of their server operations.
