Echo: openssl-3.5.0: security update to 3.5.0+e1

high Tenable Cloud Security Plugin ID 478498

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails
for initial packet. Impact summary: Double free leads to heap corruption, which typically results in
termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this
double free is exploitable for remote code execution, thus it is considered highly improbable. CWE:
CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet
handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates
successfully with QRX object, the default packet handler proceeds to channel (connection object) creation.
The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the
newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once
port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the
error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel()
function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL
packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then
port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has
invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of
the OpenSSL FIPS module boundary. (CVE-2026-18798)

Solution

Update the openssl-3.5.0 library and its related packages to version 3.5.0+e1 or later.

Plugin Details

Severity: High

ID: 478498

Version: Revision 1.1

Type: Local

Family: Echo Local Security Checks

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 92.99

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-18798

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 8/5/2026

Reference Information

CVE: CVE-2026-18798

Detections

Analytics