The developers of the open source cryptography libraries OpenSSL and WolfSSL announced patches for around a dozen vulnerabilities each, including high-severity vulnerabilities.
Of the Fixed 14 vulnerabilities in OpenSSLone was assigned a high severity level. Tracked as CVE-2026-84782, it could allow a remote peer to obtain fragments of heap memory or crash applications that use Datagram TLS (DTLS), a protocol commonly found in VPNs, VoIP, and IoT products.
The error is thrown during the DTLS handshake when OpenSSL retransmits a message while another message is blocked from sending. This may result in leftover heap data being sent to the other party in plain text. If the read reaches unallocated memory, the application crashes, resulting in a denial of service (DoS) condition.
The issue has a CVSS score of 8.2 and can be exploited over the network without authentication or user interaction.
The latest OpenSSL releases also fix a medium-severity vulnerability identified as CVE-2026-84783. A remote, unauthenticated peer could exploit the vulnerability to crash a multi-threaded TLS client and trigger a DoS condition.
The remaining vulnerabilities are of low severity. They most often lead to DoS conditions caused by excessive memory or CPU consumption, process crashes, or the termination of DTLS 1.2 connections. The rest could allow attackers to abuse QUIC servers for DDoS amplification or exploit timing side channels to collect information that could lead to private key recovery.
WolfSSL security patches
WolfSSL developers released Version 5.9.4 on September 25th. In addition to the new features, the latest version fixes 11 vulnerabilities, including three of high severity.
The serious issues could allow attackers to bypass peer authentication in certain WolfSSL configurations.
CVE-2026-93302 occurs because WolfSSL ignores the public key when matching a certificate with a trusted peer certificate. A malicious server that knows which CAs a client trusts can present a fake CA clone and bypass authentication. Affected builds include those built to integrate with Nginx, HAProxy, Stunnel, Apache httpd and other applications.
CVE-2026-89102 allows an attacker who has an arbitrary certificate (and its private key) associated with a certificate authority trusted by the client to forge certificates for arbitrary identities. CVE-2026-89136 allows a malicious server to bypass authentication on clients with raw public key support enabled by selecting an RPK certificate type that the client never requested.
Four moderate errors are certificate validation errors and one handshake sequencing error. They could allow attackers to bypass naming restrictions, inject an unverified certificate authority into the shared certificate manager, or perform a TLS 1.2 or DTLS 1.2 handshake instead of the legitimate server and send data that the client accepts as authentic.
The four low-severity errors can result in a use-after-free connection shutdown, skipped CRL revocation checks, acceptance of certificates with invalid signatures, and server impersonation. Most require specific configurations or the use of older APIs.
Related: OpenSSL silently fixes the “HollowByte” DoS vulnerability
Related: OpenSSL fixes high-level security vulnerability found using AI
Related: Fixed data leak vulnerability in OpenSSL
