← News
/DISPATCH · 2026-08-27

OpenSSL August Security Update Fixes 9 DoS Vulnerabilities: QUIC Double-Free and CMS 8-Byte Heap Overflow

On 25 Aug 2026 the OpenSSL project shipped advisories fixing 9 vulnerabilities: 2 Moderate, 7 Low, hitting QUIC, DTLS, CMS, and CMP. Officially not RCE, but heap corruption, NULL deref, and uncontrolled memory use can crash public TLS terminators.

On 25 Aug 2026 the OpenSSL project shipped advisories fixing 9 vulnerabilities: 2 Moderate, 7 Low, affecting QUIC, DTLS, CMS, CMP, and related crypto stacks. Maintainers state none of these yield RCE. Heap corruption, NULL deref, and uncontrolled memory use can still crash internet-facing TLS terminators. Impact is high for CDN, gateway, mail, and VPN infrastructure. Branches covered: 4.0, 3.6, 3.5, 3.4, 3.0. Upgrade now.

Incident overview

Nine CVEs, all DoS-focused. Highest attention:

The seven Low bugs hit CMP ASN.1 parsing, DTLS session resumption, CMS format-string formatting, RPK parsing, and AEAD forged empty ciphertext. OpenSSL says none are RCE. An attacker can still force process exit or unbounded resource use.

Technical details

CVE-2026-18798 QUIC double-free

Bug sits in the QUIC receive path:

port_default_packet_handler() -> create QRX object -> pass to port_bind_channel()
if dest connection ID length < 8 bytes -> port_bind_channel() free(QRX) fails
upper-layer error handler free()s the same QRX again -> double free

A crafted INITIAL packet with connection ID shorter than 8 bytes crashes the QUIC server process or corrupts the heap on most glibc setups. Path is reachable in the QUIC stack. Maintainers say turning it into code execution is extremely hard.

CVE-2026-63072 CMS heap OOB write

CMS (Cryptographic Message Syntax) AES-WRAP-PAD unwrap writes 8 bytes past the allocated buffer if the attacker tampers with OID bytes. Reachable through the public CMS_decrypt() API. Default-on for mail signature verify, S/MIME gateways, CA cert parsing.

Other Low CVEs

Impact assessment

OpenSSL underpins HTTPS, QUIC, S/MIME, VPN, and most internet crypto. A DoS-only bug still amplifies cheaply on CDNs, TLS gateways, mail relays, hardware load balancers, and IoT endpoints. No botnet required — one reachable port can pin the server down:

Remediation

Sources