CVE-2026-84782
Public on 2026-09-29
Modified on 2026-09-29
Description
A flaw was found in OpenSSL. The Datagram Transport Layer Security (DTLS) retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to read past the message buffer or overwrite internal state required to resume writing. This issue can result in information disclosure through out-of-bounds memory reads or cause a Denial of Service (DoS) by crashing the process.
Severity
See what this means
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Core | edk2 | Pending Fix | ||
| Amazon Linux 2023 | edk2 | Pending Fix | ||
| Amazon Linux 2 - Core | openssl | Pending Fix | ||
| Amazon Linux 2023 | openssl | Pending Fix | ||
| Amazon Linux 2027 Preview | openssl | Pending Fix | ||
| Amazon Linux 2 - Openssl-snapsafe Extra | openssl-snapsafe | Pending Fix | ||
| Amazon Linux 2 - Core | openssl11 | Pending Fix |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H |