USN-8847-1: OpenSSL vulnerabilities
Ubuntu warned of OpenSSL flaws that could cause denial of service or a timing side-channel leak.
Ubuntu published USN-8847-1 covering OpenSSL flaws. CVE-2026-35189 involves mishandled certificate revocation list distribution point names that could make OpenSSL consume excessive memory and cause a denial of service. CVE-2026-35191, affecting only Ubuntu 26.04 LTS, involves incorrect QUIC amplification-credit accounting that could also cause a denial of service. A third issue, whose CVE is not named in the truncated notice, concerns scalar multiplication on non-NIST elliptic curves and could allow a timing side-channel to expose sensitive data.
- CVE-2026-35189 can exhaust memory via crafted CRL distribution point names.
- CVE-2026-35191 is a QUIC denial-of-service issue limited to Ubuntu 26.04 LTS.
- Faulty non-NIST elliptic-curve math may enable a timing side-channel leak.
- Ubuntu does not report that any of the flaws are being exploited.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-35189+1 related CVE | OpenSSL memory-growth DoS via crafted CRL distribution points | 5.3 group max | — |
From the original article
It was discovered that OpenSSL incorrectly handled certain certificate revocation list distribution point names. An attacker could possibly use this issue to cause OpenSSL to consume excessive memory, resulting in a denial of service. (CVE-2026-35189) It was discovered that OpenSSL incorrectly handled QUIC unvalidated amplification credit accounting.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.