CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.

Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages.

CWE: CWE-354 (Improper Validation of Integrity Check Value)

Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case.

FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.

Security Fix(es):

Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth.

Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions.

CWE: CWE-770: Allocation of Resources Without Limits or Throttling

Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely.

The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all.

FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.(CVE-2026-63074)

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer.

Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service.

CWE: CWE-476: NULL Pointer Dereference

Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted.

This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable.

FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.(CVE-2026-63076)

A vulnerability was discovered in SourceCodester Simple Online Food Ordering System 1.0. The vulnerability affects unknown processing logic of the file /admin/ajax.php?action=save_menu. Manipulation of the img parameter results in arbitrary file uploads. Attackers can launch attacks remotely. The exploit code for this vulnerability has been made public and may be exploited.(CVE-2026-75803)

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.

Security Fix(es):

Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth.

Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions.

CWE: CWE-770: Allocation of Resources Without Limits or Throttling

Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely.

The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all.

FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.(CVE-2026-63074)

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer.

Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service.

CWE: CWE-476: NULL Pointer Dereference

Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted.

This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable.

FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.(CVE-2026-63076)

A vulnerability was discovered in SourceCodester Simple Online Food Ordering System 1.0. The vulnerability affects unknown processing logic of the file /admin/ajax.php?action=save_menu. Manipulation of the img parameter results in arbitrary file uploads. Attackers can launch attacks remotely. The exploit code for this vulnerability has been made public and may be exploited.(CVE-2026-75803)

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.

Security Fix(es):

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension.

Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible.

CWE: CWE-476: NULL Pointer Dereference

Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA).

When the private key is configured along with a matching certificate, the "signature_algorithms_cert" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key.

Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below.

FIPS impact: no

No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.(CVE-2026-14457)

Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet.

Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable.

CWE: CWE-415: Double Free

Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time.

The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length.

FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.(CVE-2026-18798)

Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires.

Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service.

CWE: CWE-405: Asymmetric Resource Consumption (Amplification)

Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early…

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

• openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456)
• openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798)
• openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)
• openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076)
• openssl: RPK server signature algorithm selection can dereference a missing certificate (CVE-2026-14457)
• openssl: excessive memory use buffering DTLS records for a future epoch (CVE-2026-54874)
• openssl: untrusted sender DN used as format string in CMP response validation (CVE-2026-63073)
• openssl: CMP indefinite cache growth of ExtraCerts (CVE-2026-63074)
• openssl: QUIC ACK-only packet retention can cause memory exhaustion (CVE-2026-63075)

Bug Fix(es) and Enhancement(s):

• openssl: HollowByte remote memory-exhaustion DoS fix may be missing [AlmaLinux 9.8.z] (JIRA:AlmaLinux-232828)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.

Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages.

CWE: CWE-354 (Improper Validation of Integrity Check Value)

Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case.

FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.

Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages.

CWE: CWE-354 (Improper Validation of Integrity Check Value)

Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case.

FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.

Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages.

CWE: CWE-354 (Improper Validation of Integrity Check Value)

Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case.

FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.

• CVE-2026-63074: roll back cached CMP extraCerts when a message is rejected to stop unbounded untrusted-stack growth on a long-lived ctx
• CVE-2026-63076: require the CMP protectionAlg parameter to be a SEQUENCE before using it as a PBMParameter, avoiding a pointer deref
• CVE-2026-75803: check the AEAD tag on a terminal EVP_Cipher() call for AES-OCB and ChaCha20-Poly1305 so an empty ciphertext cannot be forged

Unbounded Memory Growth in QUIC Server Incoming Channel Queue. (CVE-2026-14456) QUIC Server May Trigger Double Free When Processing INITIAL Packet. (CVE-2026-18798) Heap Buffer Overflow in CMS Key Unwrapping. (CVE-2026-63072) Invalid Pointer Dereference in CMP Server via Crafted protectionAlg. (CVE-2026-63076) RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate. (CVE-2026-14457) Excessive Memory Use Buffering DTLS Records for a Future Epoch. (CVE-2026-54874) Untrusted Sender DN Used as Format String in CMP Response Validation. (CVE-2026-63073) CMP Indefinite Cache Growth of ExtraCerts. (CVE-2026-63074) QUIC ACK-only Packet Retention Can Cause Memory Exhaustion. (CVE-2026-63075)

These are all security issues fixed in the libopenssl-3-devel-3.5.3-8.1 package on the GA media of openSUSE Tumbleweed.

This update for openssl-3 fixes the following issues:

August 2026 release.

• CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
• CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
• CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
• CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
• CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
• CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
• CVE-2026-63074: CMP indefinite cache growth of ExtraCerts (bsc#1274797).
• CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
• CVE-2026-63076: invalid pointer dereference in CMP server via crafted protectionAlg (bsc#1274790).
• CVE-2026-75803: AEAD forgeries with empty ciphertext when using EVP_Cipher() (bsc#1275837).

Root has patched CVE-2026-75803 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available.

Root has patched CVE-2026-75803 in the openssl package for Root:Debian:12. Multiple fixed versions available.

This update for openssl-3 fixes the following issues:

August 2026 release.

• CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
• CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
• CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
• CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
• CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
• CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
• CVE-2026-63074: CMP indefinite cache growth of ExtraCerts (bsc#1274797).
• CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
• CVE-2026-63076: invalid pointer dereference in CMP server via crafted protectionAlg (bsc#1274790).
• CVE-2026-75803: AEAD forgeries with empty ciphertext when using EVP_Cipher() (bsc#1275837).

This update for openssl-3 fixes the following issues:

August 2026 release.

• CVE-2026-75803: AEAD forgeries with empty ciphertext when using EVP_Cipher() (bsc#1275837).
• CVE-2026-54874: excessive memory use when buffering DTLS records for a future epoch (bsc#1274795).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
• CVE-2026-63074: unbounded growth of extraCerts cache in the CMP server (bsc#1274797).
• CVE-2026-63076: invalid pointer dereference in the CMP server via crafted protectionAlg (bsc#1274790).

This update for openssl-3 fixes the following issues:

August 2026 release.

• CVE-2026-75803: AEAD forgeries with empty ciphertext when using EVP_Cipher() (bsc#1275837).
• CVE-2026-54874: excessive memory use when buffering DTLS records for a future epoch (bsc#1274795).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
• CVE-2026-63074: unbounded growth of extraCerts cache in the CMP server (bsc#1274797).
• CVE-2026-63076: invalid pointer dereference in the CMP server via crafted protectionAlg (bsc#1274790).

This update for openssl-3 fixes the following issues:

August 2026 release.

• CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
• CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
• CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
• CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
• CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
• CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
• CVE-2026-63074: CMP indefinite cache growth of ExtraCerts (bsc#1274797).
• CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
• CVE-2026-63076: invalid pointer dereference in CMP server via crafted protectionAlg (bsc#1274790).
• CVE-2026-75803: AEAD forgeries with empty ciphertext when using EVP_Cipher() (bsc#1275837).

This update for openssl-3 fixes the following issues:

August 2026 release .

• CVE-2026-54874: excessive memory use when buffering DTLS records for a future epoch (bsc#1274795).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
• CVE-2026-63074: unbounded growth of extraCerts cache in the CMP server (bsc#1274797).
• CVE-2026-63076: invalid pointer dereference in the CMP server via crafted protectionAlg (bsc#1274790).
• CVE-2026-75803: AEAD forgeries with empty ciphertext when using EVP_Cipher() (bsc#1275837).

This update for openssl-3 fixes the following issues:

• CVE-2026-54874: Excessive Memory Use Buffering DTLS Records for a Future Epoch (bsc#1274795).
• CVE-2026-63072: Heap Buffer Overflow in CMS Key Unwrapping (bsc#1274788).
• CVE-2026-63074: CMP Indefinite Cache Growth of ExtraCerts (bsc#1274797).
• CVE-2026-63076: Invalid Pointer Dereference in CMP Server via Crafted protectionAlg (bsc#1274790).
• CVE-2026-75803: AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher() (bsc#1275837).

Changes for openssl-3:

• August 2026 release (bsc#1274774).

This update for openssl-3 fixes the following issues:

August 2026 release.

• CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
• CVE-2026-63074: CMP indefinite cache growth of ExtraCerts (bsc#1274797).
• CVE-2026-63076: invalid pointer dereference in CMP server via crafted protectionAlg (bsc#1274790).
• CVE-2026-75803: AEAD forgeries with empty ciphertext when using EVP_Cipher() (bsc#1275837).

This update for openssl-3 fixes the following issues:

August 2026 release.

• CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
• CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
• CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
• CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
• CVE-2026-54874: excessive Memory Use Buffering DTLS Records for a Future Epoch (bsc#1274795).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
• CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
• CVE-2026-63074: CMP indefinite cache growth of ExtraCerts (bsc#1274797).
• CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
• CVE-2026-63076: invalid pointer dereference in CMP server via crafted protectionAlg (bsc#1274790).
• CVE-2026-75803: AEAD forgeries with empty ciphertext when using EVP_Cipher() (bsc#1275837).

It was discovered that OpenSSL incorrectly handled the QUIC server incoming channel queue. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14456)

It was discovered that OpenSSL incorrectly handled signature algorithm selection when using Raw Public Keys. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14457)

It was discovered that OpenSSL incorrectly handled QUIC INITIAL packet processing. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-18798)

It was discovered that OpenSSL incorrectly handled buffering of DTLS records for a future epoch. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. (CVE-2026-54874)

It was discovered that OpenSSL incorrectly handled CMS key unwrapping. A remote attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial of service or arbitrary code execution. (CVE-2026-63072)

It was discovered that OpenSSL incorrectly validated the sender distinguished name in CMP response messages. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-63073)

It was discovered that OpenSSL incorrectly limited the growth of an internal certificate cache used during CMP operations. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. (CVE-2026-63074)

It was discovered that OpenSSL incorrectly handled QUIC ACK-only packet retention. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-63075)

It was discovered that OpenSSL incorrectly handled CMP protection algorithm validation. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2026-63076)

It was discovered that OpenSSL incorrectly verified authentication tags when using certain AEAD ciphers via the EVP_Cipher() interface. An attacker could possibly use this issue to perform AEAD forgery attacks. (CVE-2026-75803)

USN-8673-1 fixed vulnerabilities in OpenSSL. The update inadvertently left out the fix for CVE-2026-75803 in Ubuntu 26.04 LTS. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that OpenSSL incorrectly handled the QUIC server incoming channel queue. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14456)

It was discovered that OpenSSL incorrectly handled signature algorithm selection when using Raw Public Keys. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14457)

It was discovered that OpenSSL incorrectly handled QUIC INITIAL packet processing. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-18798)

It was discovered that OpenSSL incorrectly handled buffering of DTLS records for a future epoch. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. (CVE-2026-54874)

It was discovered that OpenSSL incorrectly handled CMS key unwrapping. A remote attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial of service or arbitrary code execution. (CVE-2026-63072)

It was discovered that OpenSSL incorrectly validated the sender distinguished name in CMP response messages. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-63073)

It was discovered that OpenSSL incorrectly limited the growth of an internal certificate cache used during CMP operations. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. (CVE-2026-63074)

It was discovered that OpenSSL incorrectly handled QUIC ACK-only packet retention. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-63075)

It was discovered that OpenSSL incorrectly handled CMP protection algorithm validation. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2026-63076)

It was discovered that OpenSSL incorrectly verified authentication tags when using certain AEAD ciphers via the EVP_Cipher() interface. An attacker could possibly use this issue to perform AEAD forgery attacks. (CVE-2026-75803)

It was discovered that EDK II incorrectly handled CMS key unwrapping in the embedded OpenSSL library. An attacker could possibly use this issue to cause a heap buffer overflow, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63072)

It was discovered that EDK II incorrectly handled CMP protection verification in the embedded OpenSSL library. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-63076)

It was discovered that EDK II incorrectly buffered DTLS records in the embedded OpenSSL library. A remote attacker could possibly use this issue to cause EDK II to consume excessive memory, resulting in a denial of service. (CVE-2026-54874)

It was discovered that EDK II incorrectly verified AEAD tags in the embedded OpenSSL library. An attacker could possibly use this issue to cause EDK II to accept forged messages. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-75803)