Affected Systems
OpenSSL versions 4.0 (before 4.0.3), 3.6 (before 3.6.5), 3.5 (before 3.5.9), 3.4 (before 3.4.8), 3.0, 1.1.1, and 1.0.2. Only affects software using OpenSSL for DTLS connections (e.g., WebRTC, VoIP). Older branches (3.0, 1.1.1, 1.0.2) require premium support for patches.
Exploitation Status
No active exploitation reported. OpenSSL has not confirmed whether an attacker can reliably trigger the condition. CISA listed exploitation as "none" as of September 29, 2026.
Business Impact
Applications using OpenSSL for DTLS (WebRTC, VoIP, UDP-based TLS) can leak unencrypted heap memory to remote peers during handshake retransmissions, exposing sensitive data. Alternatively, the flaw can crash the program if unmapped memory is accessed, causing denial of service. CISA CVSS 8.2 (Low confidentiality impact, High availability impact). Ubuntu 22.04 and 24.04 LTS users on OpenSSL 3.0 have patches available via distro packages; others building OpenSSL 3.0 from source have no public fix and must upgrade to 3.5/4.0 or purchase premium support.
Urgency
🟠Within 24 hours
Recommended Actions
- Update OpenSSL to fixed versions: 4.0.3, 3.6.5, 3.5.9, or 3.4.8 depending on branch in use.
- Ubuntu users: apply libssl3t64 updates (3.5.5-1ubuntu3.6 for 26.04, 3.0.13-0ubuntu3.16 for 24.04, 3.0.2-0ubuntu1.30 for 22.04) and reboot systems.
- Debian 13 users: update to openssl 3.5.7-1~deb13u3 (DSA-6531-1). Debian 12 users should monitor security tracker for patch availability.
- Organizations building OpenSSL 3.0 from source or embedding it: migrate to OpenSSL 3.5 LTS (supported until April 2030) or 4.0, as 3.0 public support ended September 7, 2026.
- Inventory applications using DTLS (WebRTC gateways, SIP/VoIP servers, VPN endpoints) and prioritize patching those systems.