OpenSSL Addresses Critical DTLS Flaw and Multiple Other Vulnerabilities
The OpenSSL project has issued updates fixing approximately 14 vulnerabilities, with one classified as high severity. Tracked as CVE-2026-84782, this flaw resides in the Datagram TLS (DTLS) handshake process and could allow a remote, unauthenticated attacker to obtain fragments of heap memory or cause application crashes. The vulnerability occurs when OpenSSL retransmits a DTLS message while another transmission is stalled, potentially leading to the exposure of leftover heap data in plaintext. If the memory read accesses unmapped regions, the application may crash, resulting in a denial-of-service condition. This flaw carries a CVSS score of 8.2 and is exploitable over the network without requiring authentication or user interaction. DTLS is commonly used in VPNs, VoIP systems, and IoT devices.
Additionally, OpenSSL patched a medium-severity issue tracked as CVE-2026-84783, which could allow a remote attacker to crash a multi-threaded TLS client, also leading to a denial-of-service outcome. The remaining vulnerabilities in this release are rated low severity and primarily relate to resource exhaustion, process crashes, or termination of DTLS 1.2 connections. Some of these flaws could be abused to amplify DDoS attacks via QUIC servers or exploited through timing side channels to potentially recover private keys.
WolfSSL Releases Version 5.9.4 with Fixes for Eleven Vulnerabilities
WolfSSL developers released version 5.9.4 on September 25, incorporating new features and security patches for 11 vulnerabilities. Three of these are rated high severity and relate to authentication bypass scenarios in specific configurations.
The first high-severity flaw, CVE-2026-93302, occurs when WolfSSL fails to properly verify the public key during certificate validation against a trusted peer certificate. This allows a malicious server that knows which certificate authorities a client trusts to present a forged CA clone and successfully bypass authentication. Affected configurations include those integrated with Nginx, HAProxy, Stunnel, Apache httpd, and similar applications.
The second high-severity issue, CVE-2026-89102, enables an attacker who possesses any valid certificate and its corresponding private key—provided it chains to a CA trusted by the client—to forge certificates for arbitrary identities. This could facilitate man-in-the-middle attacks under certain trust conditions.
The third high-severity vulnerability, CVE-2026-89136, affects clients with Raw Public Key (RPK) support enabled. A malicious server can bypass authentication by presenting an RPK certificate type that the client did not request, exploiting a mismatch in expected certificate handling during the handshake.
Medium and Low Severity Issues in WolfSSL
Four medium-severity flaws were also addressed in WolfSSL 5.9.4. These involve certificate validation defects and a handshake sequencing error that could allow attackers to bypass name constraints, insert an unverified CA into the shared certificate manager, or complete a TLS 1.2 or DTLS 1.2 handshake in place of the legitimate server, thereby sending data the client would accept as authentic.
The remaining four low-severity bugs include risks such as use-after-free conditions during connection shutdown, skipped CRL revocation checks, acceptance of certificates with invalid signatures, and potential server impersonation. These issues generally require specific configurations or the use of legacy APIs to be exploitable.
Both OpenSSL and WolfSSL updates are strongly recommended for all users, particularly those deploying cryptographic libraries in network-facing services such as web servers, VPN gateways, and IoT platforms. Administrators should apply the latest versions to mitigate risks associated with these vulnerabilities.
Source: SecurityWeek