OpenSSL and WolfSSL Patch High-Severity Vulnerabilities
Summary
OpenSSL fixed 14 vulnerabilities, including a high-severity DTLS flaw that could expose heap data or crash applications. WolfSSL 5.9.4 patches 11 flaws, including three high-severity authentication-bypass vulnerabilities.
Key points
- OpenSSL fixed 14 vulnerabilities. CVE-2026-84782, rated CVSS 8.2, could expose fragments of heap memory or cause a denial of service during a DTLS handshake.
- The OpenSSL flaw can be exploited remotely without authentication or user interaction; other fixes include denial-of-service, QUIC amplification, and timing side-channel issues.
- OpenSSL also fixed CVE-2026-84783, which could let an unauthenticated remote peer crash a multithreaded TLS client.
- WolfSSL released version 5.9.4 on September 25, patching 11 vulnerabilities, including three high-severity authentication-bypass flaws.
- WolfSSL CVE-2026-93302 involves certificate matching that ignores the public key; affected builds include integrations with Nginx, HAProxy, Stunnel, and Apache httpd.
- The other high-severity WolfSSL flaws can enable certificate forgery or authentication bypass when Raw Public Key support is enabled.
Article Details
- Vulnerability Types
- DTLS handshake retransmission can expose leftover heap memory or crash applications
- TLS client denial of service
- Peer authentication bypass
- Certificate validation defects
- TLS/DTLS handshake sequencing error
- Use-after-free during connection shutdown
- Skipped CRL revocation checks
- Acceptance of certificates with invalid signatures
- Server impersonation
- Severity
- High (CVSS 8.2) for CVE-2026-84782; other discussed issues range from low to high severity.
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-84782Tracked as CVE-2026-84782, it could allow a remote peer to obtain fragments of heap memory or crash applications that use Datagram TLS (DTLS), a protocol commonly found in VPNs, VoIP and IoT products.CVE-2026-84783The latest OpenSSL releases also fix a medium-severity vulnerability identified as CVE-2026-84783.CVE-2026-89102CVE-2026-89102 allows an attacker holding any certificate (and its private key) that chains to a CA trusted by the client to forge certificates for arbitrary identities.CVE-2026-89136CVE-2026-89136 lets a malicious server bypass authentication on clients with Raw Public Key support enabled by selecting an RPK certificate type the client never requested.CVE-2026-93302CVE-2026-93302 exists because WolfSSL ignores the public key when matching a certificate against a trusted peer certificate.
Vendors
OpenSSLThe developers of the OpenSSL and WolfSSL open source cryptographic libraries announced patches for roughly a dozen vulnerabilities each, including high-severity flaws.WolfSSLThe developers of the OpenSSL and WolfSSL open source cryptographic libraries announced patches for roughly a dozen vulnerabilities each, including high-severity flaws.
Products
Apache HTTP ServerAffected builds include those created for integration with Nginx, HAProxy, Stunnel, Apache httpd, and other applications.HAProxyAffected builds include those created for integration with Nginx, HAProxy, Stunnel, Apache httpd, and other applications.NGINXAffected builds include those created for integration with Nginx, HAProxy, Stunnel, Apache httpd, and other applications.OpenSSLThe developers of the OpenSSL and WolfSSL open source cryptographic libraries announced patches for roughly a dozen vulnerabilities each, including high-severity flaws.StunnelAffected builds include those created for integration with Nginx, HAProxy, Stunnel, Apache httpd, and other applications.wolfSSLThe developers of the OpenSSL and WolfSSL open source cryptographic libraries announced patches for roughly a dozen vulnerabilities each, including high-severity flaws.