CVE-2026-84782: OpenSSL DTLS retransmission heap over-read (High)
OpenSSL's DTLS retransmission logic mishandles a handshake write that was suspended part-way (WANT_WRITE): a retransmission can read past the message buffer and send leftover heap memory to the peer as plaintext handshake data, or crash the process. Only applications that use DTLS (TLS over UDP) are affected; plain TLS over TCP is not. OpenSSL rates it High; all branches from 1.0.2 to 4.0 are affected, and fixes for 3.0, 1.1.1 and 1.0.2 are available upstream only to premium support customers, so distro packages are the practical route.
- CVE-2026-84782CVE identifier
- 8.2CVSS 3.1 base score (high)
- 0.8%EPSS: chance of exploitation in the next 30 days (higher than 58% of CVEs)
- 2026-09-29published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run the affected software and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Restart services that use OpenSSL for DTLS (and, after any libssl update, preferably every service that has libssl/libcrypto loaded) or reboot.
- If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
Affected and fixed versions
Affected:
- OpenSSL 4.0.0 before 4.0.3
- OpenSSL 3.6.0 before 3.6.5
- OpenSSL 3.5.0 before 3.5.9
- OpenSSL 3.4.0 before 3.4.8
- OpenSSL 3.0.0 before 3.0.23
- OpenSSL 1.1.1 before 1.1.1zj
- OpenSSL 1.0.2 before 1.0.2zs
Fixed in:
- OpenSSL 4.0.3
- OpenSSL 3.6.5
- OpenSSL 3.5.9
- OpenSSL 3.4.8
- OpenSSL 3.0.23 (premium support)
- OpenSSL 1.1.1zj (premium support)
- OpenSSL 1.0.2zs (premium support)
Am I affected?
openssl version
dpkg -l 'libssl*' openssl | grep ^ii
rpm -q openssl openssl-libs
sudo ss -ulpnPatch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade openssl libssl3 libssl3t64Ubuntu
sudo apt update
sudo apt install --only-upgrade openssl libssl3 libssl3t64RHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh openssl openssl-libsSUSE / openSUSE
sudo zypper refresh
sudo zypper update openssl-3 libopenssl3Built from source
Upgrade to OpenSSL 4.0.3, 3.6.5, 3.5.9 or 3.4.8 (or later). 3.0, 1.1.1 and 1.0.2 fixes are released upstream to premium support customers only; use your distribution's package or move to a supported branch.General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | openssl | fixed | 3.0.22-1~deb12u2 |
| Debian 13 | openssl | fixed | 3.5.7-1~deb13u3 |
| Debian testing | openssl | fixed | 3.6.5-1 |
| Red Hat Enterprise Linux 9 | openssl-1:3.5.8-2.el9_8 | fixed | RHSA-2026:77396 |
| Red Hat Enterprise Linux 9 | compat-openssl11-1:1.1.1k-5.el9_8.6 | fixed | RHSA-2026:80514 |
| Red Hat Enterprise Linux 9 | bootc | affected | |
| Red Hat Enterprise Linux 9 | edk2 | affected | |
| Red Hat Enterprise Linux 9 | mesa | affected | |
| Red Hat Enterprise Linux 8 | compat-openssl10-1:1.0.2o-4.el8_10.4 | fixed | RHSA-2026:80510 |
| Red Hat Enterprise Linux 8 | openssl-1:1.1.1k-18.el8_6 | fixed | RHSA-2026:85968 |
| Red Hat Enterprise Linux 8 | edk2 | affected | |
| Red Hat Enterprise Linux 8 | mingw-openssl | affected | |
| Red Hat Enterprise Linux 7 | openssl | affected | |
| Red Hat Enterprise Linux 7 | ovmf | affected | |
| Red Hat Enterprise Linux 6 | openssl | affected | |
| Red Hat Enterprise Linux 10 | openssl-1:3.5.8-2.el10_2 | fixed | RHSA-2026:76918 |
| Red Hat Enterprise Linux 10 | bootc | affected | |
| Red Hat Enterprise Linux 10 | clevis-pin-tpm2 | affected | |
| Red Hat Enterprise Linux 10 | edk2 | affected | |
| Red Hat Enterprise Linux 10 | rust-sevctl | affected | |
| Debian 13 (trixie) | openssl | fixed | 3.5.7-1~deb13u3 (DSA-6531-1) |
| Debian 12 (bookworm) | openssl | fixed | 3.0.22-1~deb12u2 (DLA-4859-1) |
| Ubuntu 26.04 LTS (resolute) | openssl | fixed | 3.5.5-1ubuntu3.6 (USN-8847-1) |
| Ubuntu 24.04 LTS (noble) | openssl | fixed | 3.0.13-0ubuntu3.16 (USN-8847-1) |
| Ubuntu 22.04 LTS (jammy) | openssl | fixed | 3.0.2-0ubuntu1.30 (USN-8847-1) |
| RHEL 10 | openssl | fixed | 3.5.8-2.el10_2 (RHSA-2026:76918) |
| RHEL 9 | openssl | fixed | 3.5.8-2.el9_8 (RHSA-2026:77396) |
| RHEL 8 | openssl | fixed | 1.1.1k-18.el8_6 (RHSA-2026:85968) |
| SUSE Linux Enterprise Server 16.0 | openssl-3 | fixed | 3.5.0-160000.11.1 |
| SUSE Linux Enterprise Server 15 SP7 | openssl-3 | fixed | 3.5.0-150700.5.53.2 |
| SUSE Linux Enterprise Server 15 SP7 | openssl-1_1 | fixed | 1.1.1w-150700.11.35.1 |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
If you cannot patch yet
- OpenSSL lists no workaround. Only DTLS users are exposed; services that use TLS over TCP only are not affected by this issue.
Related vulnerabilities
Sources
- OpenSSL Security Advisory 2026-09-29
- OpenSSL vulnerabilities list
- CVE record CVE-2026-84782
- Debian DSA-6531-1 openssl
- Debian security tracker
- Ubuntu CVE page
- Red Hat CVE page
- SUSE CVE page
- https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c
- https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58
- https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943
- https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628
- CVE-2026-84782 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.