PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54874 OpenSSL CVE debrief

OpenSSL DTLS Memory Amplification Denial of Service. Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. This issue allows a peer to use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, potentially leading to a Denial of Service. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2 are vulnerable. Defenders responsible for OpenSSL DTLS endpoints, particularly those using vulnerable versions, should assess exposure and prioritize upgrades to prevent potential Denial of Service attacks.

Vendor
OpenSSL
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-25
Original CVE updated
2026-09-11
Advisory published
2026-08-25
Advisory updated
2026-09-11

Who should care

Defenders responsible for OpenSSL DTLS endpoints, particularly those using vulnerable versions, should assess exposure and prioritize upgrades to prevent potential Denial of Service attacks.

Why it matters

Defenders should prioritize upgrading vulnerable OpenSSL versions to prevent potential Denial of Service attacks. The issue allows a peer to use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2 are vulnerable.

  • Memory amplification factor of around 1200, allowing a peer to cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory
  • Potential Denial of Service due to memory exhaustion
  • Verification of vulnerable OpenSSL versions and upgrade to fixed versions required
  • Exposure assessment and inventory checks recommended

Technical summary

The OpenSSL DTLS Memory Amplification Denial of Service vulnerability occurs when a DTLS record for a future epoch is received while a handshake is in progress. This causes OpenSSL to buffer significantly more memory than the record requires, allowing a peer to use minimal network traffic to make the OpenSSL DTLS endpoint retain a large amount of memory, potentially leading to a Denial of Service. The vulnerability affects OpenSSL versions 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2. A peer can exploit this by sending a stream of small forged records claiming to belong to the next epoch, causing the OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory. This issue has a memory amplification factor of 120

Defensive priority

Defenders should prioritize upgrading vulnerable OpenSSL versions to prevent potential Denial of Service attacks.

Recommended defensive actions

  • Upgrade OpenSSL 4.0 to 4.0.2
  • Upgrade OpenSSL 3.6 to 3.6.4
  • Upgrade OpenSSL 3.5 to 3.5.8
  • Upgrade OpenSSL 3.4 to 3.4.7
  • Upgrade OpenSSL 3.0 to 3.0.22
  • Upgrade OpenSSL 1.1.1 to 1.1.1zi
  • Upgrade OpenSSL 1.0.2 to 1.0.2zr

Evidence notes

The issue is caused by OpenSSL buffering DTLS records for a future epoch during a handshake, allowing a peer to use a small amount of network traffic to make the OpenSSL DTLS endpoint retain a disproportionately large amount of memory. This may lead to a Denial of Service.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54874 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54874

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54874 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54874

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.