Echo: openssl-3.5.0: security update to 3.5.0+e1

high Tenable Cloud Security Plugin ID 478457

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer
dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer
dereference typically causes abnormal termination of the affected QUIC server process and a Denial of
Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can
crash the server by sending an initial packet with an invalid or expired token. By default, the client
address validation is enabled in the OpenSSL QUIC server implementation, which makes the default
configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the
SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable. The FIPS
modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the
OpenSSL FIPS module boundary. (CVE-2026-42764)

Solution

Update the openssl-3.5.0 library and its related packages to version 3.5.0+e1 or later.

Plugin Details

Severity: High

ID: 478457

Version: Revision 1.1

Type: Local

Family: Echo Local Security Checks

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.62

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-42764

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 6/9/2026

Reference Information

CVE: CVE-2026-42764

Detections

Analytics