PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54874 OpenSSL CVE debrief

OpenSSL DTLS memory amplification vulnerability. Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires, potentially leading to a Denial of Service. Defenders responsible for OpenSSL DTLS endpoints, particularly those using vulnerable versions, should assess exposure and prioritize patching. The vulnerability allows a peer to cause an OpenSSL DTLS endpoint to retain a disproportionately large amount of memory, which may lead to a Denial of Service. A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain around 1.7 megabytes of memory per connection. OpenSSL

Vendor
OpenSSL
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-25
Original CVE updated
2026-09-11
Advisory published
2026-08-25
Advisory updated
2026-09-11

Who should care

Defenders responsible for OpenSSL DTLS endpoints, particularly those using vulnerable versions, should assess exposure and prioritize patching to prevent potential Denial of Service attacks.

Why it matters

Defenders should prioritize patching vulnerable OpenSSL versions to prevent potential Denial of Service attacks. The vulnerability allows a peer to cause an OpenSSL DTLS endpoint to retain a disproportionately large amount of memory, potentially leading to a Denial of Service. Affected roles include those responsible for OpenSSL DTLS endpoints, particularly those using vulnerable versions.

  • Memory amplification factor of around 1200, allowing a peer to cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory per connection
  • Potential Denial of Service due to memory exhaustion
  • Verification of affected versions and remediation priority

Technical summary

The vulnerability occurs when a DTLS record for a future epoch is received while a handshake is in progress, causing OpenSSL to buffer far more memory than the record itself requires. A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, potentially leading to a Denial of Service. This is achieved by sending a stream of small forged records claiming to belong to the next epoch, which can cause the endpoint to retain around 1.7 megabytes of memory per connection. The memory amplification factor is around 1200. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2 are vulnerable to this issue. Upgrades are recommended for OpenSSL 4.0 to 4

Defensive priority

Defenders should prioritize patching vulnerable OpenSSL versions to prevent potential Denial of Service attacks.

Recommended defensive actions

  • Upgrade OpenSSL 4.0 to 4.0.2
  • Upgrade OpenSSL 3.6 to 3.6.4
  • Upgrade OpenSSL 3.5 to 3.5.8
  • Upgrade OpenSSL 3.4 to 3.4.7
  • Upgrade OpenSSL 3.0 to 3.0.22

Evidence notes

The vulnerability allows a peer to cause an OpenSSL DTLS endpoint to retain a disproportionately large amount of memory, potentially leading to a Denial of Service. This is achieved by sending a stream of small forged records claiming to belong to the next epoch, which can cause the endpoint to retain around 1.7 megabytes of memory per connection.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54874 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54874

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54874 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54874

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.