Detections
Analytics

Echo: openssl: security update to 3.5.7-1~deb13u2

high Tenable Self-Hosted Container Security Plugin ID 464490

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for
 unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any
 limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster
 than the application accepts connections, can cause the memory allocated to store the per-channel state to
 grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service.
 CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles
 inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC
 channel). If no existing connection is found and the packet type is INITIAL, the function treats the
 packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits
 to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial
 channel objects may grow without bounds if the application is not able to call SSL_accept() frequently
 enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC
 server implementation was added. The fix introduces a limit for pending connections. The default limit is
 set to 256 pending connections (waiting to be accepted by the local application). Applications may change
 the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the
 QUIC implementation is outside of the OpenSSL FIPS module boundary. (CVE-2026-14456)

Solution

Update the openssl library and its related packages to version 3.5.7-1~deb13u2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-14456

Plugin Details

Severity: High

ID: 464490

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.59

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-14456

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/17/2026

Vulnerability Publication Date: 8/5/2026

Reference Information

CVE: CVE-2026-14456

IAVA: 2026-A-0878-S