Detections
Analytics

Echo: openssl-3.5.0: security update to 3.5.0+e1

high Tenable Self-Hosted Container Security Plugin ID 478529

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by
 avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local
 QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID
 frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withholds ACKs, then it can
 force the local stack to allocate ~400MB (depending on ACK delay). CWE: CWE-770: Allocation of Resources
 Without Limits or Throttling Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism by
 which a remote peer can notify the local QUIC stack to change the destination connection ID (a.k.a. CID)
 the local stack uses to identify the connection at the remote peer. Each CID is associated with a sequence
 number. The sequence number is transmitted in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to
 identify the CID which is being either associated with a connection or retired. The remote peer sends a
 NEW_CONNECTION_ID frame to let the local stack know a new CID is being associated with an existing
 connection. The NEW_CONNECTION_ID frame carries the new CID, its sequence number, and the retire-prior-to
 number. The retire-prior-to identifies existing CIDs that are to be retired. The local QUIC stack must
 send a RETIRE_CONNECTION_ID for every destination CID whose sequence number is less than retire-prior-to.
 The CID becomes retired after the local stack receives an ACK for its RETIRE_CONNECTION_ID frame. Although
 the OpenSSL QUIC stack supports at most one destination CID for every connection, it can be tricked into
 processing more than one RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC stack currently
 retires the destination CID as soon as it receives the NEW_CONNECTION_ID, while in fact the destination
 CID must be retired after an ACK for the RETIRE_CONNECTION_ID frame is received. Correcting the flawed
 logic also fixes the backlog growth. [1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-
 connection-ids FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of
 the OpenSSL FIPS module boundary. (CVE-2026-84784)

Solution

Update the openssl-3.5.0 library and its related packages to version 3.5.0+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-84784

Plugin Details

Severity: High

ID: 478529

Version: Revision 1.1

Type: Local

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

Percentile: 96.1

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-84784

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 9/29/2026

Reference Information

CVE: CVE-2026-84784