CLSA-2026-1788271054
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1788271054.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788271054
- Upstream
CVE (2)
- Published
- 2026-09-01T13:57:45Z
- Modified
- 2026-10-26T09:31:40Z
- Summary
- Fix CVE(s): CVE-2026-54874, CVE-2026-63072
- Details
-
- SECURITY UPDATE: Memory amplification denial of service in the DTLS
record layer: buffering a record that arrives early for the next epoch
retained the entire read buffer, sized for the largest possible DTLS
record (~16.7KB), rather than only the record's own bytes, so a peer
sending a stream of small forged next-epoch records could make an
endpoint retain around 1.7MB per connection.
- debian/patches/CVE-2026-54874.patch: copy only the record's on-wire bytes into the queue entry and rebase the record pointers on retrieval in ssl/record/rec_layer_d1.c, ssl/record/record.h, ssl/record/record_local.h and ssl/record/ssl3_record.c, and lower the unprocessed_rcds queue limit to 16.
- CVE-2026-54874
- SECURITY UPDATE: Out-of-bounds heap write in CMS decryption: the
key-unwrap output buffer was sized from the cipher's length query, but
the AES-WRAP-PAD unwrap primitive writes and cleanses up to inlen bytes
on its integrity-failure paths, so a crafted CMS message naming a
padded key-wrap OID caused an 8-byte write past the allocation.
- debian/patches/CVE-2026-63072.patch: size the unwrap output buffer for the worst case in cms_kek_cipher() in crypto/cms/cms_kari.c.
- CVE-2026-63072
- SECURITY UPDATE: Memory amplification denial of service in the DTLS
record layer: buffering a record that arrives early for the next epoch
retained the entire read buffer, sized for the largest possible DTLS
record (~16.7KB), rather than only the record's own bytes, so a peer
sending a stream of small forged next-epoch records could make an
endpoint retain around 1.7MB per connection.
- References
Affected packages
TuxCare:Ubuntu:20.04 / libssl-dev
Package
- Name
- libssl-dev
- Purl
- pkg:deb/tuxcare/libssl-dev?distro=ubuntu-20.04
TuxCare:Ubuntu:20.04 / libssl-doc
Package
- Name
- libssl-doc
- Purl
- pkg:deb/tuxcare/libssl-doc?distro=ubuntu-20.04
TuxCare:Ubuntu:20.04 / libssl1.1
Package
- Name
- libssl1.1
- Purl
- pkg:deb/tuxcare/libssl1.1?distro=ubuntu-20.04