CVE-2026-14457

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension.

Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible.

CWE: CWE-476: NULL Pointer Dereference

Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA).

When the private key is configured along with a matching certificate, the "signature_algorithms_cert" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key.

Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below.

FIPS impact: no

No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the "signature_algorithms_cert" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.

Security Fix(es):

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension.

Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible.

CWE: CWE-476: NULL Pointer Dereference

Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA).

When the private key is configured along with a matching certificate, the "signature_algorithms_cert" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key.

Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below.

FIPS impact: no

No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.(CVE-2026-14457)

Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet.

Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable.

CWE: CWE-415: Double Free

Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time.

The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length.

FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.(CVE-2026-18798)

Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires.

Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service.

CWE: CWE-405: Asymmetric Resource Consumption (Amplification)

Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early…

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

• openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456)

• openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798)

• openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)

• openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076)

• openssl: RPK server signature algorithm selection can dereference a missing certificate (CVE-2026-14457)

• openssl: excessive memory use buffering DTLS records for a future epoch (CVE-2026-54874)

• openssl: untrusted sender DN used as format string in CMP response validation (CVE-2026-63073)

• openssl: CMP indefinite cache growth of ExtraCerts (CVE-2026-63074)

• openssl: QUIC ACK-only packet retention can cause memory exhaustion (CVE-2026-63075)

Bug Fix(es) and Enhancement(s):

• openssl: HollowByte remote memory-exhaustion DoS fix may be missing [Rocky Linux 10.2.z] (JIRA:Rocky Linux-212362)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

• openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456)

• openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798)

• openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)

• openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076)

• openssl: RPK server signature algorithm selection can dereference a missing certificate (CVE-2026-14457)

• openssl: excessive memory use buffering DTLS records for a future epoch (CVE-2026-54874)

• openssl: untrusted sender DN used as format string in CMP response validation (CVE-2026-63073)

• openssl: CMP indefinite cache growth of ExtraCerts (CVE-2026-63074)

• openssl: QUIC ACK-only packet retention can cause memory exhaustion (CVE-2026-63075)

Bug Fix(es) and Enhancement(s):

• openssl: HollowByte remote memory-exhaustion DoS fix may be missing [Rocky Linux 9.8.z] (JIRA:Rocky Linux-232828)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the "signature_algorithms_cert" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

• openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456)
• openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798)
• openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)
• openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076)
• openssl: RPK server signature algorithm selection can dereference a missing certificate (CVE-2026-14457)
• openssl: excessive memory use buffering DTLS records for a future epoch (CVE-2026-54874)
• openssl: untrusted sender DN used as format string in CMP response validation (CVE-2026-63073)
• openssl: CMP indefinite cache growth of ExtraCerts (CVE-2026-63074)
• openssl: QUIC ACK-only packet retention can cause memory exhaustion (CVE-2026-63075)

Bug Fix(es) and Enhancement(s):

• openssl: HollowByte remote memory-exhaustion DoS fix may be missing [AlmaLinux 10.2.z] (JIRA:AlmaLinux-212362)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

• openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456)
• openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798)
• openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)
• openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076)
• openssl: RPK server signature algorithm selection can dereference a missing certificate (CVE-2026-14457)
• openssl: excessive memory use buffering DTLS records for a future epoch (CVE-2026-54874)
• openssl: untrusted sender DN used as format string in CMP response validation (CVE-2026-63073)
• openssl: CMP indefinite cache growth of ExtraCerts (CVE-2026-63074)
• openssl: QUIC ACK-only packet retention can cause memory exhaustion (CVE-2026-63075)

Bug Fix(es) and Enhancement(s):

• openssl: HollowByte remote memory-exhaustion DoS fix may be missing [AlmaLinux 9.8.z] (JIRA:AlmaLinux-232828)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-63074: roll cached CMP extraCerts back off ctx->untrusted on both message-rejection paths, so a client that repeatedly sends rejected messages can no longer grow a long-lived OSSL_CMP_CTX without bound
• CVE-2026-63076: require the CMP protectionAlg parameter to be a V_ASN1_SEQUENCE before it is used as a PBMParameter, so a crafted parameter of another ASN.1 type is no longer dereferenced as a bogus pointer
• CVE-2026-14457: skip the signature_algorithms_cert restriction when RFC 7250 raw public keys are negotiated and reject a key-only slot when they are not, so a peer soliciting raw public keys against a key-only configuration can no longer trigger a NULL pointer dereference in check_cert_usable()
• CVE-2026-63075: stop recording ACK-only QUIC packets in the TX history while still advancing the history's highest sent packet number, so a peer that withholds acknowledgements can no longer drive unbounded memory growth

Unbounded Memory Growth in QUIC Server Incoming Channel Queue. (CVE-2026-14456) QUIC Server May Trigger Double Free When Processing INITIAL Packet. (CVE-2026-18798) Heap Buffer Overflow in CMS Key Unwrapping. (CVE-2026-63072) Invalid Pointer Dereference in CMP Server via Crafted protectionAlg. (CVE-2026-63076) RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate. (CVE-2026-14457) Excessive Memory Use Buffering DTLS Records for a Future Epoch. (CVE-2026-54874) Untrusted Sender DN Used as Format String in CMP Response Validation. (CVE-2026-63073) CMP Indefinite Cache Growth of ExtraCerts. (CVE-2026-63074) QUIC ACK-only Packet Retention Can Cause Memory Exhaustion. (CVE-2026-63075)

These are all security issues fixed in the libopenssl-3-devel-3.5.3-8.1 package on the GA media of openSUSE Tumbleweed.

This update for openssl-3 fixes the following issues:

August 2026 release.

• CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
• CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
• CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
• CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
• CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
• CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
• CVE-2026-63074: CMP indefinite cache growth of ExtraCerts (bsc#1274797).
• CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
• CVE-2026-63076: invalid pointer dereference in CMP server via crafted protectionAlg (bsc#1274790).
• CVE-2026-75803: AEAD forgeries with empty ciphertext when using EVP_Cipher() (bsc#1275837).

This update for openssl-3 fixes the following issues:

August 2026 release.

• CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
• CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
• CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
• CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
• CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
• CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
• CVE-2026-63074: CMP indefinite cache growth of ExtraCerts (bsc#1274797).
• CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
• CVE-2026-63076: invalid pointer dereference in CMP server via crafted protectionAlg (bsc#1274790).
• CVE-2026-75803: AEAD forgeries with empty ciphertext when using EVP_Cipher() (bsc#1275837).

This update for openssl-3-livepatches fixes the following issues:

• CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1275145, bsc#1274792).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1275133, bsc#1274788).
• CVE-2026-63076: invalid pointer dereference in CMP server via crafted protectionAlg (bsc#1275143, bsc#1274790).

This update for openssl-3-x86_64-v3-livepatches fixes the following issues:

• HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations (bsc#1271713, bsc#1271712).
• CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1275145, bsc#1274792).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1275133, bsc#1274788).
• CVE-2026-63076: invalid pointer dereference in CMP server via crafted protectionAlg (bsc#1275143, bsc#1274790).

This update for openssl-3 fixes the following issues:

August 2026 release.

• CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
• CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
• CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
• CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
• CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
• CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
• CVE-2026-63074: CMP indefinite cache growth of ExtraCerts (bsc#1274797).
• CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
• CVE-2026-63076: invalid pointer dereference in CMP server via crafted protectionAlg (bsc#1274790).
• CVE-2026-75803: AEAD forgeries with empty ciphertext when using EVP_Cipher() (bsc#1275837).

This update for openssl-3-livepatches fixes the following issues:

• "HollowByte" DoS via attacker-controlled memory allocation (bsc#1271712).
• CVE-2026-14457: RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate (bsc#1274792).
• CVE-2026-63072: Heap Buffer Overflow in CMS Key Unwrapping (bsc#1274788).
• CVE-2026-63076: Invalid Pointer Dereference in CMP Server via Crafted protectionAlg (bsc#1274790).

This update for openssl-3-livepatches fixes the following issues:

• "HollowByte" DoS via attacker-controlled memory allocation (bsc#1271712).
• CVE-2026-14457: RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate (bsc#1274792).
• CVE-2026-63072: Heap Buffer Overflow in CMS Key Unwrapping (bsc#1274788).
• CVE-2026-63076: Invalid Pointer Dereference in CMP Server via Crafted protectionAlg (bsc#1274790).

This update for openssl-3-livepatches fixes the following issues:

• CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1275145, bsc#1274792).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1275133, bsc#1274788).
• CVE-2026-63076: invalid pointer dereference in CMP server via crafted protectionAlg (bsc#1275143, bsc#1274790).

This update for openssl-3 fixes the following issues:

August 2026 release.

• CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
• CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
• CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
• CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
• CVE-2026-54874: excessive Memory Use Buffering DTLS Records for a Future Epoch (bsc#1274795).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
• CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
• CVE-2026-63074: CMP indefinite cache growth of ExtraCerts (bsc#1274797).
• CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
• CVE-2026-63076: invalid pointer dereference in CMP server via crafted protectionAlg (bsc#1274790).
• CVE-2026-75803: AEAD forgeries with empty ciphertext when using EVP_Cipher() (bsc#1275837).

This update for openssl-3-livepatches fixes the following issues:

• CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1275145, bsc#1274792).
• CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1275133, bsc#1274788).
• CVE-2026-63076: invalid pointer dereference in CMP server via crafted protectionAlg (bsc#1275143, bsc#1274790).

It was discovered that OpenSSL incorrectly handled the QUIC server incoming channel queue. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14456)

It was discovered that OpenSSL incorrectly handled signature algorithm selection when using Raw Public Keys. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14457)

It was discovered that OpenSSL incorrectly handled QUIC INITIAL packet processing. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-18798)

It was discovered that OpenSSL incorrectly handled buffering of DTLS records for a future epoch. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. (CVE-2026-54874)

It was discovered that OpenSSL incorrectly handled CMS key unwrapping. A remote attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial of service or arbitrary code execution. (CVE-2026-63072)

It was discovered that OpenSSL incorrectly validated the sender distinguished name in CMP response messages. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-63073)

It was discovered that OpenSSL incorrectly limited the growth of an internal certificate cache used during CMP operations. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. (CVE-2026-63074)

It was discovered that OpenSSL incorrectly handled QUIC ACK-only packet retention. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-63075)

It was discovered that OpenSSL incorrectly handled CMP protection algorithm validation. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2026-63076)

It was discovered that OpenSSL incorrectly verified authentication tags when using certain AEAD ciphers via the EVP_Cipher() interface. An attacker could possibly use this issue to perform AEAD forgery attacks. (CVE-2026-75803)