CVE-2026-75806

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-75806

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75806.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-75806

Downstream

USN-8847-1

Published

2026-09-29T15:32:21Z

Modified

2026-09-30T08:06:05Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS

Details

Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead.

Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. This is a Denial of Service limited to the targeted association. There is no memory safety or confidentiality impact.

CWE: CWE-1284: Improper Validation of Specified Quantity in Input

Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and an authentication tag. When decrypting such a record the record layer passed the record length to the cipher implementation before checking that the record was long enough to contain the explicit IV and the tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and the record layer treated this as an internal failure and raised a fatal internal_error alert instead of treating the record as one that failed authentication.

In TLS 1.2 the same record causes a fatal internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS.

The fix validates the record length against the explicit IV and tag length before any AEAD processing, so that TLS reports bad_record_mac and DTLS silently discards the record.

FIPS impact: no The affected code is outside the FIPS module boundary.

Database specific

{
    "cna_assigner":  "openssl",
    "cwe_ids":  [
        "CWE-1284"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75806.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "4.0.0"
                },
                {
                    "fixed":  "4.0.3"
                },
                {
                    "introduced":  "3.6.0"
                },
                {
                    "fixed":  "3.6.5"
                },
                {
                    "introduced":  "3.5.0"
                },
                {
                    "fixed":  "3.5.9"
                },
                {
                    "introduced":  "3.4.0"
                },
                {
                    "fixed":  "3.4.8"
                },
                {
                    "introduced":  "3.0.0"
                },
                {
                    "fixed":  "3.0.23"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/openssl/openssl

Affected ranges

Type

GIT

Repo

https://github.com/openssl/openssl

Events

Introduced

e04bd3433fd84e1861bf258ea37928d9845e6a86

Fixed

e04bd3433fd84e1861bf258ea37928d9845e6a86

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.1.1"
        },
        {
            "fixed":  "1.1.1zj"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75806.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "28170854778703993674264004058177114599",
                "73132526844288570625317440636111911761",
                "177405411499435185068645597737938634778",
                "224809958623850711330610094965797758930",
                "295554444428855106393106961197201359586"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-75806-c377fa22",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/e04bd3433fd84e1861bf258ea37928d9845e6a86",
        "target":  {
            "file":  "include/openssl/opensslv.h"
        }
    }
]

vanir_signatures_modified

"2026-09-30T08:06:05Z"