CVE-2026-84782

Public on 2026-09-29
Modified on 2026-09-29
Description
A flaw was found in OpenSSL. The Datagram Transport Layer Security (DTLS) retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to read past the message buffer or overwrite internal state required to resume writing. This issue can result in information disclosure through out-of-bounds memory reads or cause a Denial of Service (DoS) by crashing the process.
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
7.4
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core edk2 Pending Fix
Amazon Linux 2023 edk2 Pending Fix
Amazon Linux 2 - Core openssl Pending Fix
Amazon Linux 2023 openssl Pending Fix
Amazon Linux 2027 Preview openssl Pending Fix
Amazon Linux 2 - Openssl-snapsafe Extra openssl-snapsafe Pending Fix
Amazon Linux 2 - Core openssl11 Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H