Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-84782, CVE-2026-84783, CVE-2026-84784, CVE-2026-72897
By Nevo Evenhaim |
30 September 2026
Multiple CVEs – OpenSSL DTLS, X.509, QUIC and SSL_CTX flaws (heap leak, UAF, memory exhaustion, OOB)
OpenSSL addresses four issues: CVE-2026-84782: Retransmit of suspended WANT_WRITE can OOB-read and leak heap bytes as plaintext handshake data or crash. (Affects 1.0.2-4.0 fixed in 1.0.2zs / 1.1.1zj / 3.0.23 / 3.4.8 / 3.5.9 / 3.6.5 / 4.0.3).
CVE-2026-84783 : Extension-cache use-after-free on concurrent first use of the same trusted CA in multi-threaded TLS (Affects 4.0 fixed in 4.0.3).
CVE-2026-84784 : Unbounded RETIRE_CONNECTION_ID backlog lets a peer force ~400 MB allocation / DoS (Affects 3.4-4.0 fixed in 3.4.8 / 3.5.9 / 3.6.5 / 4.0.3).
CVE-2026-72897: OOB access after mid-handshake SSL_set_SSL_CTX() when the new context has more provider sigalgs (Affects 3.4-4.0 same fixes as CVE-2026-84784).