Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests client certificates, if the first certificate chains built to the same trusted CA certificate are built by several connections at the same time. This is a use-after-free read, which is likely to crash the process, resulting in a Denial of Service. CWE: CWE-416: Use After Free Description: OpenSSL caches the decoded values of a certificate's X.509v3 extensions inside the X509 object the first time they are needed. In OpenSSL 4.0 this cache is built in two phases: the extension values are computed while holding a read lock on the certificate, and the results are then installed into the certificate under a write lock. Because a read lock does not exclude other readers, several threads can compute the cache for the same certificate at the same time. Each thread that subsequently acquires the write lock installs its own results and frees the values installed by the thread before it, even though that earlier thread has already marked the cache as complete and may have returned pointers into it to its caller. A caller still using those pointers then reads freed memory. Any certificate shared between threads is exposed the first time its extensions are decoded. In TLS the certificates at risk are the trusted CA certificates supplied for chain verification, by whatever means, since these are shared by every connection and their extensions are decoded and cached the first time a chain is built to them. Certificates sent by the peer are decoded separately for each connection and are not shared, so they are not affected. In a TLS client verifying server certificates, or a TLS server that requests and verifies client certificates, the use-after-free could only occur if the first chains built to the same trusted CA are built by several connections at the same time. FIPS impact: no The FIPS module is not affected as X.509 certificate handling is outside of the OpenSSL FIPS module boundary. OpenSSL 4.0 is vulnerable to this issue. OpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. This issue was reported on 27 August 2026 by Tim Becker (Xint.io) and independently in a public report on 31 August 2026 by aydinmercan. The fix has been developed by Bob Beck. -- cut (non-publishing metadata for internal use) -- Reported by: Tim Becker (Xint.io), aydinmercan Fixed by: Bob Beck

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0d183075-bcb5-11f1-b09d-8447094a420f advisory.

    The OpenSSL project reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 4.0.3. It is, therefore, affected by multiple vulnerabilities as referenced in the 4.0.3 advisory.

  - Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is     suspended part-way through. The retransmitted message can be read past the message buffer and the     retransmission overwrites the internal state the suspended write needs to resume correctly. Impact     summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or     cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-     of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write     can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more     data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the     retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue.
    The retransmission logic reused the same internal buffer and position tracking as the message that was     still being written, without resetting the position back to the start of the message being retransmitted.
    As a result the retransmission was read starting from wherever the suspended write had left off, producing     a mislabelled message whose body was leftover bytes from the other, larger message still in flight -     content that was never meant to be sent at that point, and which could run past the end of the allocated     buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion     while another write is suspended overwrites the same shared bookkeeping that the suspended write depends     on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(),     SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with     the message and aborts the process in a debugging build. The fix resets the retransmission's read position     to the start of the message before resending, and skips retransmission entirely whenever a handshake write     is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code     is outside the FIPS module boundary. (CVE-2026-84782)

  - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes     disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted     certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service     in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without     Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for     size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of     resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the     client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix     postpones processing of the CRL distribution points extensions in certificates to the time when the     processed value is required for CRL processing. This avoids keeping large memory allocations for a long     time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module     boundary. (CVE-2026-35189)

  - Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced     to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of     the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact     summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might     use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation     Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC     9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this     feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3     times the amount of data received from the peer address, until such time as the TLS handshake is     completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole     datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A     remote peer may, after establishing a connection with an initial client hello frame, send a subsequent     datagram containing multiple QUIC packets, leading the server to account the entire datagram length for     each packet in the datagram, resulting in the server believing that the peer has sent more data than it     actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the     QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
    (CVE-2026-35191)

  - Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are     arriving out of order. The worst case has a quadratic complexity proportional to the number of stream     frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes     the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using     compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407:
    Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a     doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a     head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By     manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations,     consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the     QUIC implementation is outside of the OpenSSL FIPS module boundary. (CVE-2026-42772)

  - Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature     operations with curves that do not have a dedicated implementation leaks information about the secret     nonce through timing. Impact summary: An attacker able to measure signing times may learn information     about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number     Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy     Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated     constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time     taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very     small; observing it requires a large number of measurements. The effect is largest for curves whose group     order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the     Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic     implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated     constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the     approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use     the affected code path. (CVE-2026-54872)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its     cached extension data to be freed while another thread is still using it. Impact summary: A remote,     unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests     client certificates, if the first certificate chains built to the same trusted CA certificate are built by     several connections at the same time. This is a use-after-free read, which is likely to crash the process,     resulting in a Denial of Service. CWE: CWE-416: Use After Free Description: OpenSSL caches the decoded     values of a certificate's X.509v3 extensions inside the X509 object the first time they are needed. In     OpenSSL 4.0 this cache is built in two phases: the extension values are computed while holding a read lock     on the certificate, and the results are then installed into the certificate under a write lock. Because a     read lock does not exclude other readers, several threads can compute the cache for the same certificate     at the same time. Each thread that subsequently acquires the write lock installs its own results and frees     the values installed by the thread before it, even though that earlier thread has already marked the cache     as complete and may have returned pointers into it to its caller. A caller still using those pointers then     reads freed memory. Any certificate shared between threads is exposed the first time its extensions are     decoded. In TLS the certificates at risk are the trusted CA certificates supplied for chain verification,     by whatever means, since these are shared by every connection and their extensions are decoded and cached     the first time a chain is built to them. Certificates sent by the peer are decoded separately for each     connection and are not shared, so they are not affected. In a TLS client verifying server certificates, or     a TLS server that requests and verifies client certificates, the use-after-free could only occur if the     first chains built to the same trusted CA are built by several connections at the same time. FIPS impact:
    no The FIPS module is not affected as X.509 certificate handling is outside of the OpenSSL FIPS module     boundary. OpenSSL 4.0 is vulnerable to this issue. OpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not     affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. This issue was reported on 27     August 2026 by Tim Becker (Xint.io) and independently in a public report on 31 August 2026 by aydinmercan.
    The fix has been developed by Bob Beck. -- cut (non-publishing metadata for internal use) -- Reported by:
    Tim Becker (Xint.io), aydinmercan Fixed by: Bob Beck (CVE-2026-84783)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
353457	FreeBSD : OpenSSL -- Multiple vulnerabilities (0d183075-bcb5-11f1-b09d-8447094a420f)	Nessus	FreeBSD Local Security Checks	Local	high
352189	OpenSSL 4.0.0 < 4.0.3 Multiple Vulnerabilities	Nessus	Web Servers	Combined	high
351203	Linux Distros Unpatched Vulnerability : CVE-2026-84783	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-84783

high

Tenable Plugins

high

high

high