Secorizon (Organization): news timeline & CVEs

OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory Unencrypted

OpenSSL patches high-severity DTLS flaw CVE-2026-84782 (CVSS 8.2) that can leak unencrypted heap memory or crash DTLS connections.

CVE-2026-84782 is a high-severity OpenSSL flaw where a DTLS handshake message resend during a paused larger message send can transmit mislabeled data containing heap memory as unencrypted handshake data, or crash on unmapped memory. Fixes are available in OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8, while 3.0, 1.1.1 and 1.0.2 fixes are limited to premium support customers. CISA assigned CVSS 8.2 and listed exploitation as none. The September 29 releases also fix 13 other flaws, including moderate CVE-2026-84783 (crash in multithreaded TLS) and low CVE-2026-75806 (DTLS 1.2 AEAD connection reset).

The Hacker NewsSep 30, 08:09 UTC · 10d agoVulnerability CVE-2026-84782 CVE-2026-84783 CVE-2026-758062· 1 read

OpenSSL Fixes High-Severity Bug That Can Leak Server Memory in Plaintext

OpenSSL patched CVE-2026-84782, a high-severity DTLS flaw that can leak heap memory or crash servers.

OpenSSL patched CVE-2026-84782, a high-severity out-of-bounds read in DTLS handshake retransmission disclosed on September 29, 2026. A stale read offset can attach leftover bytes and send adjacent heap memory to a peer as plaintext, or crash the process if the read hits unmapped memory. All branches are affected, including 4.0 before 4.0.3, 3.6 before 3.6.5, 3.5 before 3.5.9, and 3.4 before 3.4.8; older 3.0, 1.1.1, and 1.0.2 fixes are limited to premium support. FIPS modules are outside the affected boundary, and OpenSSL 4.0.3 also addresses 13 additional issues.

Cyber Security NewsSep 30, 03:14 UTC · 11d agoVulnerability CVE-2026-847824· 3 reads

Secorizon

Timeline2 articles

Related CVEsby mentions

Appears with

OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory Unencrypted

OpenSSL Fixes High-Severity Bug That Can Leak Server Memory in Plaintext