OpenSSL 25 August 2026: nine flaws across QUIC, CMS, CMP, DTLS and AEAD
Three Moderate and six Low issues include double free, heap overflow, DoS and skipped AEAD-tag verification. Exposure analysis and fixed releases 4.0.2–3.0.22.
- AUTHOR
- Karol Rapacz / CEO Breachroad · OSCP · PNPT
- PUBLISHED
- 25 August 2026
- READING TIME
- 20 min read
- TOPIC
- Vulnerabilities and CVEs
OpenSSL published a coordinated advisory on 25 August covering nine vulnerabilities. Three are Moderate and six Low under the project’s severity scale. The problems span different layers: the QUIC server, CMS decryption, CMP processing, Raw Public Keys, DTLS buffering and a one-shot AEAD API. There is no single “does TLS work?” test that can establish whether an application is safe.
Fixed versions in supported branches are OpenSSL 4.0.2, 3.6.4, 3.5.8, 3.4.7 and 3.0.22. Premium customers maintaining older lines received 1.1.1zi and 1.0.2zr for issues affecting those branches. OpenSSL 3.1, 3.2 and 3.3 are out of support and were not analysed; absence from an affected list does not establish safety.
Three Moderate vulnerabilities
CVE-2026-18798 affects QUIC servers in 4.0, 3.6 and 3.5. While processing an INITIAL packet, code creates a QRX record-layer object for validation. If channel creation fails after ownership is passed, one path frees QRX and later error handling frees it again. A remote peer can trigger the condition with a non-compliant INITIAL packet carrying a destination connection ID shorter than eight bytes. The double free corrupts the heap and typically terminates the process; the project considers RCE highly improbable and has no evidence for it.
CVE-2026-63072 reaches CMS_decrypt() in 4.0, 3.6, 3.5, 3.4, 3.0 and 1.1.1. An attacker can modify the key-wrap algorithm OID to select AES-WRAP-PAD. Code queried unwrapped-key size and allocated from that value, but during an integrity failure the padded unwrap primitive could write and cleanse eight bytes more. The outcome is a deterministic eight-byte zero write just beyond the heap allocation and normally denial of service. The official description does not claim RCE.
CVE-2026-63076 affects password-protected CMP in branches 4.0 through 3.0. Verification checked that the protectionAlg parameter pointer was non-null but not its ASN.1 type before treating it as PBMParameter. A crafted message can cause invalid-pointer dereference before MAC calculation. A CMP server accepting PBM can be crashed remotely without knowledge of the secret; a client can be targeted by a malicious or intercepted endpoint. The reliable effect is a crash, with no memory disclosure and no code-execution path.
Six Low issues that still require context
CVE-2026-14457 causes null dereference in an RFC 7250 Raw Public Keys configuration when only a private key, without its matching certificate, is configured locally and a peer requests RPK while sending the usually omitted signature_algorithms_cert extension. It affects 4.0–3.4 and results in denial of service. A configuration carrying a matching certificate does not enter this path.
CVE-2026-54874 abuses buffering of future-epoch DTLS records during a handshake. A small record retained its entire roughly 16 KB read buffer, while up to one hundred records could remain per connection. OpenSSL estimates about 1.7 MB retained and a memory-amplification factor around 1200 relative to attacker traffic. The per-connection amount is bounded, but many associations can exhaust memory. Affected lines range from 4.0 down to 1.0.2.
CVE-2026-63073 is a format-string flaw in a CMP client. The distinguished name of an unexpected response sender entered ERR_raise_data() as the format, leaving % characters active. A malicious or intercepted server can crash a client that validates an expected sender or pins a certificate. The project explicitly rules out reliable controlled write and RCE. Releases 4.0–3.4 are affected.
CVE-2026-63074 concerns a long-lived OSSL_CMP_CTX. Additional extraCerts from a rejected message remained in the context’s untrusted certificate stack. Repeated requests with unique certificates could produce unbounded server memory growth. The fix removes objects introduced by a rejected message. It affects 4.0–3.0.
CVE-2026-63075 affects QUIC packet history. A peer that completes a handshake can force ACK-only responses by sending ack-eliciting packets and then withholding later acknowledgements. Metadata for ACK-only packets remained for the connection lifetime even though the protocol does not require those packets to be acknowledged. Long or numerous sessions cause memory growth. Releases 4.0–3.4 are affected.
CVE-2026-75803 differs because it concerns integrity. When decrypting an empty ChaCha20-Poly1305 or AES-OCB ciphertext through one-shot EVP_Cipher(), the function could report success without checking the AEAD tag. An application trusting the return code might accept a forged empty message. It affects 4.0–3.0; FIPS modules are not affected because these algorithms are not implemented there.
“FIPS impact: no” does not mean an application can skip the update
Every section says the FIPS module is unaffected, but for different reasons. QUIC, TLS, DTLS, CMS and CMP sit outside the cryptographic module boundary; ChaCha20-Poly1305 and AES-OCB are not FIPS algorithms in the modules described. An application using the FIPS provider may still invoke vulnerable protocol code in the surrounding OpenSSL library.
Module compliance describes the validated cryptographic boundary, not immunity of the full process from memory errors. A team should determine whether it uses CMP, CMS, QUIC or DTLS regardless of FIPS configuration. The particular AEAD path is distinct because its algorithms are unavailable in the FIPS module itself.
Establishing real exposure
Begin with the library loaded at runtime. A system command can report a different OpenSSL from the one statically linked into a server, agent or appliance. Containers may carry multiple copies through the package manager, Python, Node, Java JNI or a vendor bundle. Map each process to the concrete library file and determine whether a distribution vendor backported the fixes.
A distribution version does not always increase to upstream 3.0.22. Debian, Ubuntu, Red Hat and appliance vendors often transplant a fix while retaining the base number with a package suffix. Use the vendor advisory and package build identifier rather than a naive string comparison.
Then evaluate features. A public HTTP/3 server may enter QUIC paths, an IoT gateway may use DTLS, a PKI system may use CMP, and a document-encryption service may use CMS. A process using only classic TLS 1.3 is not automatically reachable through all nine issues, although it should still use a supported library.
Update ordering and tests
Prioritise public QUIC servers, DTLS endpoints with many associations, services decrypting untrusted CMS, and CMP servers reachable without a trusted network layer. Next update CMP clients, RPK applications and systems that use one-shot EVP_Cipher() for AEAD. OpenSSL’s deployment scale means even a Low issue can have high operational cost in a particular component.
After updating, test handshakes, application configuration reload, HTTP/3, DTLS session recovery, CMS operations and CMP enrolment. Restart processes as well: replacing a package on disk does not update a library already mapped into memory. Static linking requires rebuilding and redeploying the application.
Do not search for one universal IOC. Most issues cause crashes or memory consumption, so correlate restarts, OOM events, protocol errors and connection growth. CVE-2026-75803 may produce no crash; review applications for empty AEAD messages and whether success from EVP_Cipher() is treated as the sole proof of authenticity.
Lessons for protocol and library developers
Three issues involve memory ownership or sizing: QRX double free, an undersized unwrap buffer, and retention of a full DTLS buffer. Two more show that protocol metadata needs a lifetime bound: ACK-only history and extraCerts. CMP also demonstrates that ASN.1 type and format-string handling belong to the data boundary, not merely diagnostics.
Tests should cover error paths after partial ownership transfer, size queries that differ from final operations, empty payloads and resources a peer has no obligation to acknowledge. Input fuzzing remains useful, but state assertions after message rejection and long-duration memory tests are equally important.
Source facts and Breachroad conclusions
The number of flaws, severities, mechanisms, affected branches, fixed releases and impact assessments come from the official OpenSSL Security Advisory dated 25 August. The project does not report active exploitation or confirmed RCE for the memory-safety issues. Moderate and Low findings should not be relabelled “critical zero-days” without evidence.
Deployment priorities, runtime inventory, protocol tests and observability guidance are Breachroad conclusions. Secure coding and infrastructure security training helps teams reason about protocol boundaries, while application and service penetration testing can assess deployment resilience and safe library use.
