Detections
Analytics

Echo: openssl-3.5.0: security update to 3.5.0+e1

medium Tenable Self-Hosted Container Security Plugin ID 478512

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers
 may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious
 remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive
 ~100MB of memory instead of 768 KiB (default flow control window size). CWE: CWE-770: Allocation of
 Resources Without Limits or Throttling Description: The local QUIC stack advertises two flow control
 limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer
 must follow both limits when transmitting stream data. Whenever the local QUIC stack receives a stream
 frame, it validates that the size of the received stream frame stays within flow control limits. If either
 limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a
 flow control error. The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-
 level limit. To exploit the issue, three conditions must be met: - the remote peer opens several streams -
 each stream must stay within the stream-level flow control limit - there must be no zero-offset byte sent
 on any of the streams (to prevent the vulnerable QUIC stack from consuming data). By meeting the
 conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control
 limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and
 unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The
 remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection. FIPS impact: no
 The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.
 (CVE-2026-75804)

Solution

Update the openssl-3.5.0 library and its related packages to version 3.5.0+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-75804

Plugin Details

Severity: Medium

ID: 478512

Version: Revision 1.1

Type: Local

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-75804

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 9/29/2026

Reference Information

CVE: CVE-2026-75804