Detections
Analytics

Echo: openssl-3.5.0: security update to 3.5.0+e1

low Tenable Cloud Security Plugin ID 478574

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced
 to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of
 the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact
 summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might
 use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation
 Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC
 9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this
 feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3
 times the amount of data received from the peer address, until such time as the TLS handshake is
 completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole
 datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A
 remote peer may, after establishing a connection with an initial client hello frame, send a subsequent
 datagram containing multiple QUIC packets, leading the server to account the entire datagram length for
 each packet in the datagram, resulting in the server believing that the peer has sent more data than it
 actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the
 QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
 (CVE-2026-35191)

Solution

Update the openssl-3.5.0 library and its related packages to version 3.5.0+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-35191

Plugin Details

Severity: Low

ID: 478574

Version: Revision 1.1

Type: Local

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-35191

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 9/29/2026

Reference Information

CVE: CVE-2026-35191