Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr <file>' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.

freebsd 0d183075-bcb5-11f1-b09d-8447094a420f: OpenSSL -- Multiple vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.6.5. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.6.5 advisory.

  - Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is     suspended part-way through. The retransmitted message can be read past the message buffer and the     retransmission overwrites the internal state the suspended write needs to resume correctly. Impact     summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or     cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-     of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write     can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more     data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the     retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue.
    The retransmission logic reused the same internal buffer and position tracking as the message that was     still being written, without resetting the position back to the start of the message being retransmitted.
    As a result the retransmission was read starting from wherever the suspended write had left off, producing     a mislabelled message whose body was leftover bytes from the other, larger message still in flight -     content that was never meant to be sent at that point, and which could run past the end of the allocated     buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion     while another write is suspended overwrites the same shared bookkeeping that the suspended write depends     on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(),     SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with     the message and aborts the process in a debugging build. The fix resets the retransmission's read position     to the start of the message before resending, and skips retransmission entirely whenever a handshake write     is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code     is outside the FIPS module boundary. (CVE-2026-84782)

  - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes     disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted     certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service     in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without     Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for     size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of     resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the     client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix     postpones processing of the CRL distribution points extensions in certificates to the time when the     processed value is required for CRL processing. This avoids keeping large memory allocations for a long     time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module     boundary. (CVE-2026-35189)

  - Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced     to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of     the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact     summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might     use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation     Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC     9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this     feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3     times the amount of data received from the peer address, until such time as the TLS handshake is     completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole     datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A     remote peer may, after establishing a connection with an initial client hello frame, send a subsequent     datagram containing multiple QUIC packets, leading the server to account the entire datagram length for     each packet in the datagram, resulting in the server believing that the peer has sent more data than it     actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the     QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
    (CVE-2026-35191)

  - Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are     arriving out of order. The worst case has a quadratic complexity proportional to the number of stream     frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes     the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using     compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407:
    Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a     doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a     head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By     manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations,     consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the     QUIC implementation is outside of the OpenSSL FIPS module boundary. (CVE-2026-42772)

  - Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature     operations with curves that do not have a dedicated implementation leaks information about the secret     nonce through timing. Impact summary: An attacker able to measure signing times may learn information     about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number     Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy     Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated     constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time     taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very     small; observing it requires a large number of measurements. The effect is largest for curves whose group     order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the     Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic     implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated     constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the     approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use     the affected code path. (CVE-2026-54872)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.0.23. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.23 advisory.

  - Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is     suspended part-way through. The retransmitted message can be read past the message buffer and the     retransmission overwrites the internal state the suspended write needs to resume correctly. Impact     summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or     cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-     of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write     can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more     data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the     retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue.
    The retransmission logic reused the same internal buffer and position tracking as the message that was     still being written, without resetting the position back to the start of the message being retransmitted.
    As a result the retransmission was read starting from wherever the suspended write had left off, producing     a mislabelled message whose body was leftover bytes from the other, larger message still in flight -     content that was never meant to be sent at that point, and which could run past the end of the allocated     buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion     while another write is suspended overwrites the same shared bookkeeping that the suspended write depends     on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(),     SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with     the message and aborts the process in a debugging build. The fix resets the retransmission's read position     to the start of the message before resending, and skips retransmission entirely whenever a handshake write     is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code     is outside the FIPS module boundary. (CVE-2026-84782)

  - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes     disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted     certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service     in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without     Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for     size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of     resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the     client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix     postpones processing of the CRL distribution points extensions in certificates to the time when the     processed value is required for CRL processing. This avoids keeping large memory allocations for a long     time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module     boundary. (CVE-2026-35189)

  - Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature     operations with curves that do not have a dedicated implementation leaks information about the secret     nonce through timing. Impact summary: An attacker able to measure signing times may learn information     about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number     Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy     Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated     constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time     taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very     small; observing it requires a large number of measurements. The effect is largest for curves whose group     order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the     Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic     implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated     constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the     approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use     the affected code path. (CVE-2026-54872)

  - Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may     dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact     summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for     the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking     a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR     instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr     <file>' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via     OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of     the certificate, so the client does not send them. A server may optionally name the certificate it revoked     in its response, and the client then compares that name against what it sent. Having sent neither an     issuer name nor a serial number, it has nothing to compare against, and a server returning a specially     crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked     for valid message protection before the affected code is reached, so an attacker must be a malicious or     compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection.
    Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather     than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the     CMP protocol implementation is outside the OpenSSL FIPS module boundary. (CVE-2026-75805)

  - Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a     single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and     authentication tag overhead. Impact summary: An attacker who can send a datagram that is routed to an     existing DTLS 1.2 association can tear that association down without knowing any key material. This is a     Denial of Service limited to the targeted association. There is no memory safety or confidentiality     impact. CWE: CWE-1284: Improper Validation of Specified Quantity in Input Description: In TLS 1.2 and DTLS     1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and     an authentication tag. When decrypting such a record the record layer passed the record length to the     cipher implementation before checking that the record was long enough to contain the explicit IV and the     tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and     the record layer treated this as an internal failure and raised a fatal internal_error alert instead of     treating the record as one that failed authentication. In TLS 1.2 the same record causes a fatal     internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already     terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS. The     fix validates the record length against the explicit IV and tag length before any AEAD processing, so that     TLS reports bad_record_mac and DTLS silently discards the record. FIPS impact: no The affected code is     outside the FIPS module boundary. (CVE-2026-75806)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.4.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.4.8 advisory.

  - Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is     suspended part-way through. The retransmitted message can be read past the message buffer and the     retransmission overwrites the internal state the suspended write needs to resume correctly. Impact     summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or     cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-     of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write     can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more     data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the     retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue.
    The retransmission logic reused the same internal buffer and position tracking as the message that was     still being written, without resetting the position back to the start of the message being retransmitted.
    As a result the retransmission was read starting from wherever the suspended write had left off, producing     a mislabelled message whose body was leftover bytes from the other, larger message still in flight -     content that was never meant to be sent at that point, and which could run past the end of the allocated     buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion     while another write is suspended overwrites the same shared bookkeeping that the suspended write depends     on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(),     SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with     the message and aborts the process in a debugging build. The fix resets the retransmission's read position     to the start of the message before resending, and skips retransmission entirely whenever a handshake write     is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code     is outside the FIPS module boundary. (CVE-2026-84782)

  - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes     disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted     certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service     in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without     Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for     size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of     resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the     client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix     postpones processing of the CRL distribution points extensions in certificates to the time when the     processed value is required for CRL processing. This avoids keeping large memory allocations for a long     time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module     boundary. (CVE-2026-35189)

  - Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are     arriving out of order. The worst case has a quadratic complexity proportional to the number of stream     frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes     the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using     compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407:
    Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a     doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a     head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By     manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations,     consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the     QUIC implementation is outside of the OpenSSL FIPS module boundary. (CVE-2026-42772)

  - Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature     operations with curves that do not have a dedicated implementation leaks information about the secret     nonce through timing. Impact summary: An attacker able to measure signing times may learn information     about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number     Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy     Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated     constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time     taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very     small; observing it requires a large number of measurements. The effect is largest for curves whose group     order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the     Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic     implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated     constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the     approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use     the affected code path. (CVE-2026-54872)

  - Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary.
    Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making     the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory     remains allocated is entirely under the control of the potentially malicious remote peer. CWE: CWE-770:
    Allocation of Resources Without Limits or Throttling Description: To save copy operation from the packet     buffer to the stream reassemble buffer the QUIC stack leaves the stream data on the packet buffer waiting     to be copied to a buffer provided by the local receiving application. The QUIC stack releases a reference     to the packet buffer only after the data are copied to the application buffer. This design is more     efficient for legitimate data transfers but enables an attacker to allocate a lot more memory than     actually required by the data kept in the receiving stream buffer. To mitigate the vulnerability, the QUIC     stack now calculates and monitors memory overhead for every stream. The memory overhead for a single     stream frame is calculated as a difference between the size of the whole packet that carries the stream     frame and the size of the stream frame itself. The memory overhead for a single stream frame is added to     the total (cumulative) memory overhead QUIC stack keeps for each stream. Once the cumulative memory     overhead exceeds 64kB, the QUIC stack moves the stream frame data from the packet buffer to the stream     buffer, starting with the next packet received. FIPS impact: no The FIPS module is not affected as the     QUIC implementation is outside of the OpenSSL FIPS module boundary. (CVE-2026-54873)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.5.9. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.5.9 advisory.

  - Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is     suspended part-way through. The retransmitted message can be read past the message buffer and the     retransmission overwrites the internal state the suspended write needs to resume correctly. Impact     summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or     cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-     of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write     can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more     data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the     retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue.
    The retransmission logic reused the same internal buffer and position tracking as the message that was     still being written, without resetting the position back to the start of the message being retransmitted.
    As a result the retransmission was read starting from wherever the suspended write had left off, producing     a mislabelled message whose body was leftover bytes from the other, larger message still in flight -     content that was never meant to be sent at that point, and which could run past the end of the allocated     buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion     while another write is suspended overwrites the same shared bookkeeping that the suspended write depends     on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(),     SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with     the message and aborts the process in a debugging build. The fix resets the retransmission's read position     to the start of the message before resending, and skips retransmission entirely whenever a handshake write     is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code     is outside the FIPS module boundary. (CVE-2026-84782)

  - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes     disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted     certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service     in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without     Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for     size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of     resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the     client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix     postpones processing of the CRL distribution points extensions in certificates to the time when the     processed value is required for CRL processing. This avoids keeping large memory allocations for a long     time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module     boundary. (CVE-2026-35189)

  - Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced     to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of     the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact     summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might     use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation     Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC     9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this     feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3     times the amount of data received from the peer address, until such time as the TLS handshake is     completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole     datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A     remote peer may, after establishing a connection with an initial client hello frame, send a subsequent     datagram containing multiple QUIC packets, leading the server to account the entire datagram length for     each packet in the datagram, resulting in the server believing that the peer has sent more data than it     actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the     QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
    (CVE-2026-35191)

  - Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are     arriving out of order. The worst case has a quadratic complexity proportional to the number of stream     frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes     the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using     compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407:
    Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a     doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a     head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By     manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations,     consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the     QUIC implementation is outside of the OpenSSL FIPS module boundary. (CVE-2026-42772)

  - Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature     operations with curves that do not have a dedicated implementation leaks information about the secret     nonce through timing. Impact summary: An attacker able to measure signing times may learn information     about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number     Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy     Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated     constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time     taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very     small; observing it requires a large number of measurements. The effect is largest for curves whose group     order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the     Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic     implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated     constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the     approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use     the affected code path. (CVE-2026-54872)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 4.0.3. It is, therefore, affected by multiple vulnerabilities as referenced in the 4.0.3 advisory.

  - Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is     suspended part-way through. The retransmitted message can be read past the message buffer and the     retransmission overwrites the internal state the suspended write needs to resume correctly. Impact     summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or     cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-     of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write     can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more     data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the     retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue.
    The retransmission logic reused the same internal buffer and position tracking as the message that was     still being written, without resetting the position back to the start of the message being retransmitted.
    As a result the retransmission was read starting from wherever the suspended write had left off, producing     a mislabelled message whose body was leftover bytes from the other, larger message still in flight -     content that was never meant to be sent at that point, and which could run past the end of the allocated     buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion     while another write is suspended overwrites the same shared bookkeeping that the suspended write depends     on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(),     SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with     the message and aborts the process in a debugging build. The fix resets the retransmission's read position     to the start of the message before resending, and skips retransmission entirely whenever a handshake write     is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code     is outside the FIPS module boundary. (CVE-2026-84782)

  - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes     disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted     certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service     in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without     Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for     size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of     resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the     client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix     postpones processing of the CRL distribution points extensions in certificates to the time when the     processed value is required for CRL processing. This avoids keeping large memory allocations for a long     time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module     boundary. (CVE-2026-35189)

  - Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced     to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of     the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact     summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might     use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation     Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC     9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this     feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3     times the amount of data received from the peer address, until such time as the TLS handshake is     completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole     datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A     remote peer may, after establishing a connection with an initial client hello frame, send a subsequent     datagram containing multiple QUIC packets, leading the server to account the entire datagram length for     each packet in the datagram, resulting in the server believing that the peer has sent more data than it     actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the     QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
    (CVE-2026-35191)

  - Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are     arriving out of order. The worst case has a quadratic complexity proportional to the number of stream     frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes     the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using     compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407:
    Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a     doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a     head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By     manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations,     consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the     QUIC implementation is outside of the OpenSSL FIPS module boundary. (CVE-2026-42772)

  - Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature     operations with curves that do not have a dedicated implementation leaks information about the secret     nonce through timing. Impact summary: An attacker able to measure signing times may learn information     about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number     Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy     Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated     constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time     taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very     small; observing it requires a large number of measurements. The effect is largest for curves whose group     order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the     Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic     implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated     constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the     approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use     the affected code path. (CVE-2026-54872)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6531 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6531-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     September 30, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : openssl     CVE ID         : CVE-2026-35189 CVE-2026-35191 CVE-2026-42772 CVE-2026-54872                      CVE-2026-54873 CVE-2026-54875 CVE-2026-72897 CVE-2026-75804                      CVE-2026-75805 CVE-2026-75806 CVE-2026-77696 CVE-2026-84782                      CVE-2026-84784

    Multiple vulnerabilities have been discovered in OpenSSL, a Secure     Sockets Layer toolkit, which could result in denial of service,     information disclosure or potentially recovery of private keys.

    Additional details can be found in the upstream advisories:
    https://openssl-library.org/news/secadv/20260929.txt

    For the stable distribution (trixie), these problems have been fixed in     version 3.5.7-1~deb13u3.

    We recommend that you upgrade your openssl packages.

    For the detailed security status of openssl please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/openssl

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8847-1 advisory.

    It was discovered that OpenSSL incorrectly handled certain certificate revocation list distribution point     names. An attacker could possibly use this issue to cause OpenSSL to consume excessive memory, resulting     in a denial of service. (CVE-2026-35189)

    It was discovered that OpenSSL incorrectly handled QUIC unvalidated amplification credit accounting. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04     LTS. (CVE-2026-35191)

    It was discovered that OpenSSL incorrectly implemented scalar multiplication for non-NIST elliptic curves.
    An attacker could possibly use this issue to perform a timing side-channel attack and obtain sensitive     information. (CVE-2026-54872)

    It was discovered that OpenSSL incorrectly implemented SM2 scalar multiplication on ARM64 and RISC-V     architectures. An attacker could possibly use this issue to perform a timing side-channel attack and     obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-54875)

    It was discovered that OpenSSL incorrectly handled SSL context switching during a TLS handshake. An     attacker could possibly use this issue to cause an out-of-bounds read, resulting in a denial of service or     obtaining sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-72897)

    It was discovered that OpenSSL incorrectly enforced QUIC connection- level flow control for streams. An     attacker could possibly use this issue to cause OpenSSL to consume excessive memory, resulting in a denial     of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-75804)

    It was discovered that OpenSSL incorrectly handled a NULL pointer in CMP client revocation response     processing. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-75805)

    It was discovered that OpenSSL incorrectly handled undersized DTLS 1.2 AEAD records before authentication.
    An attacker could possibly use this issue to cause a denial of service. (CVE-2026-75806)

    It was discovered that OpenSSL incorrectly implemented SM2 signature generation. An attacker could     possibly use this issue to perform a timing side-channel attack and obtain sensitive information.
    (CVE-2026-77696)

    It was discovered that OpenSSL incorrectly handled DTLS retransmission of handshake messages. An attacker     could possibly use this issue to cause incorrect handshake behavior or a denial of service.
    (CVE-2026-84782)

    It was discovered that OpenSSL incorrectly handled QUIC RETIRE_CONNECTION_ID frames. An attacker could     possibly use this issue to cause OpenSSL to consume excessive memory, resulting in a denial of service.
    This issue only affected Ubuntu 26.04 LTS. (CVE-2026-84784)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may     dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact     summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for     the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking     a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR     instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr     <file>' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via     OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of     the certificate, so the client does not send them. A server may optionally name the certificate it revoked     in its response, and the client then compares that name against what it sent. Having sent neither an     issuer name nor a serial number, it has nothing to compare against, and a server returning a specially     crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked     for valid message protection before the affected code is reached, so an attacker must be a malicious or     compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection.
    Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather     than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the     CMP protocol implementation is outside the OpenSSL FIPS module boundary. (CVE-2026-75805)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
352194	OpenSSL 3.6.0 < 3.6.5 Multiple Vulnerabilities	Nessus	Web Servers	Combined	high
352193	OpenSSL 3.0.0 < 3.0.23 Multiple Vulnerabilities	Nessus	Web Servers	Combined	high
352191	OpenSSL 3.4.0 < 3.4.8 Multiple Vulnerabilities	Nessus	Web Servers	Combined	high
352190	OpenSSL 3.5.0 < 3.5.9 Multiple Vulnerabilities	Nessus	Web Servers	Combined	high
352189	OpenSSL 4.0.0 < 4.0.3 Multiple Vulnerabilities	Nessus	Web Servers	Combined	high
351475	Debian dsa-6531 : libcrypto3-udeb - security update	Nessus	Debian Local Security Checks	Local	high
351469	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenSSL vulnerabilities (USN-8847-1)	Nessus	Ubuntu Local Security Checks	Local	high
351160	Linux Distros Unpatched Vulnerability : CVE-2026-75805	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-75805

medium

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

medium