Home / mailings

PDF

[USN-8847-1] OpenSSL vulnerabilities

Posted on 29 September 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8847-1
September 29, 2026

openssl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in OpenSSL.

Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

It was discovered that OpenSSL incorrectly handled certain certificate
revocation list distribution point names. An attacker could possibly use
this issue to cause OpenSSL to consume excessive memory, resulting in a
denial of service. (CVE-2026-35189)

It was discovered that OpenSSL incorrectly handled QUIC unvalidated
amplification credit accounting. An attacker could possibly use this
issue to cause a denial of service. This issue only affected
Ubuntu 26.04 LTS. (CVE-2026-35191)

It was discovered that OpenSSL incorrectly implemented scalar
multiplication for non-NIST elliptic curves. An attacker could possibly
use this issue to perform a timing side-channel attack and obtain
sensitive information. (CVE-2026-54872)

It was discovered that OpenSSL incorrectly implemented SM2 scalar
multiplication on ARM64 and RISC-V architectures. An attacker could
possibly use this issue to perform a timing side-channel attack and
obtain sensitive information. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-54875)

It was discovered that OpenSSL incorrectly handled SSL context switching
during a TLS handshake. An attacker could possibly use this issue to
cause an out-of-bounds read, resulting in a denial of service or
obtaining sensitive information. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-72897)

It was discovered that OpenSSL incorrectly enforced QUIC connection-
level flow control for streams. An attacker could possibly use this
issue to cause OpenSSL to consume excessive memory, resulting in a
denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-75804)

It was discovered that OpenSSL incorrectly handled a NULL pointer in
CMP client revocation response processing. An attacker could possibly
use this issue to cause a denial of service. (CVE-2026-75805)

It was discovered that OpenSSL incorrectly handled undersized DTLS 1.2
AEAD records before authentication. An attacker could possibly use this
issue to cause a denial of service. (CVE-2026-75806)

It was discovered that OpenSSL incorrectly implemented SM2 signature
generation. An attacker could possibly use this issue to perform a
timing side-channel attack and obtain sensitive information.
(CVE-2026-77696)

It was discovered that OpenSSL incorrectly handled DTLS retransmission
of handshake messages. An attacker could possibly use this issue to
cause incorrect handshake behavior or a denial of service.
(CVE-2026-84782)

It was discovered that OpenSSL incorrectly handled QUIC
RETIRE_CONNECTION_ID frames. An attacker could possibly use this issue
to cause OpenSSL to consume excessive memory, resulting in a denial of
service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-84784)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
libssl3t64 3.5.5-1ubuntu3.6

Ubuntu 24.04 LTS
libssl3t64 3.0.13-0ubuntu3.16

Ubuntu 22.04 LTS
libssl3 3.0.2-0ubuntu1.30

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8847-1
CVE-2026-35189, CVE-2026-35191, CVE-2026-54872, CVE-2026-54875,
CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806,
CVE-2026-77696, CVE-2026-84782, CVE-2026-84784

Package Information:
https://launchpad.net/ubuntu/+source/openssl/3.5.5-1ubuntu3.6
https://launchpad.net/ubuntu/+source/openssl/3.0.13-0ubuntu3.16
https://launchpad.net/ubuntu/+source/openssl/3.0.2-0ubuntu1.30

--===============4065292399641917882==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP