CVE-2026-75806

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-75806
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75806.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-75806
Downstream
ALPINE (1)
AZL (9)
BELL (1)
CGA (8)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (1)
openSUSE (1)
RHSA (2)
SUSE (6)
UBUNTU (1)
Related
openSUSE (1)
SUSE (6)
Published
2026-09-29T15:32:21Z
Modified
2026-10-20T18:21:33Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS
Details

Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead.

Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. This is a Denial of Service limited to the targeted association. There is no memory safety or confidentiality impact.

CWE: CWE-1284: Improper Validation of Specified Quantity in Input

Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and an authentication tag. When decrypting such a record the record layer passed the record length to the cipher implementation before checking that the record was long enough to contain the explicit IV and the tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and the record layer treated this as an internal failure and raised a fatal internal_error alert instead of treating the record as one that failed authentication.

In TLS 1.2 the same record causes a fatal internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS.

The fix validates the record length against the explicit IV and tag length before any AEAD processing, so that TLS reports bad_record_mac and DTLS silently discards the record.

FIPS impact: no The affected code is outside the FIPS module boundary.

Database specific 
{
    "cna_assigner":  "openssl",
    "cwe_ids":  [
        "CWE-1284"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75806.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "3.0.0"
                },
                {
                    "fixed":  "3.0.23"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/openssl/openssl

Affected ranges

Type
GIT
Repo
https://github.com/openssl/openssl
Events
Introduced
e04bd3433fd84e1861bf258ea37928d9845e6a86
Fixed
e04bd3433fd84e1861bf258ea37928d9845e6a86
Introduced
98acb6b02839c609ef5b837794e08d906d965335
Fixed
e72c946f6f6d94c8ba5119acb25340b7b6b2073f
Introduced
636dfadc70ce26f2473870570bfd9ec352806b1d
Fixed
45e844fa2a14ec92d146bd8f5778ac130b6625fb
Introduced
7b371d80d959ec9ab4139d09d78e83c090de9779
Fixed
c8bd5a57108599ac650bbae77fcabe3109dab2e8
Introduced
11b7b6ea3b65a584e1d31408ed1bdb139465cffd
Fixed
af1775b60dfa141a4ad762585052cabeb9f37e9e
Fixed
04728a289a823e68137f88da016cb9ede307217d
Fixed
050b275cd671a6eed1d6457642d41a5a77aab972
Fixed
3a4589d015a9049d47b66f186cf50a8711343a1d
Fixed
5af82fefbaf2b5fec2fc0e1d87f112844902f01d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.1.1"
                },
                {
                    "fixed":  "1.1.1zj"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.4.0"
                },
                {
                    "fixed":  "3.4.8"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.5.0"
                },
                {
                    "fixed":  "3.5.9"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.6.0"
                },
                {
                    "fixed":  "3.6.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0.0"
                },
                {
                    "fixed":  "4.0.3"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "04728a289a823e68137f88da016cb9ede307217d"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "050b275cd671a6eed1d6457642d41a5a77aab972"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "3a4589d015a9049d47b66f186cf50a8711343a1d"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "5af82fefbaf2b5fec2fc0e1d87f112844902f01d"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*
3.4-POST-CLANG-FORMAT-WEBKIT
3.4-PRE-CLANG-FORMAT-WEBKIT
3.5-POST-CLANG-FORMAT-WEBKIT
3.5-PRE-CLANG-FORMAT-WEBKIT
3.6-POST-CLANG-FORMAT-WEBKIT
3.6-PRE-CLANG-FORMAT-WEBKIT
openssl-3.*
openssl-3.4.0
openssl-3.4.1
openssl-3.4.2
openssl-3.4.3
openssl-3.4.4
openssl-3.4.5
openssl-3.4.6
openssl-3.4.7
openssl-3.5.0
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
openssl-3.5.4
openssl-3.5.5
openssl-3.5.6
openssl-3.5.7
openssl-3.5.8
openssl-3.6.0
openssl-3.6.1
openssl-3.6.2
openssl-3.6.3
openssl-3.6.4
openssl-4.*
openssl-4.0.0
openssl-4.0.1
openssl-4.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75806.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "46802128701133338046612924953216767471",
            "length":  4812
        },
        "id":  "CVE-2026-75806-0461fb20",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d",
        "target":  {
            "file":  "ssl/record/methods/tls1_meth.c",
            "function":  "tls1_cipher"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "326949955695709015371510383455528221162",
                "239840320733268454235032776929266371090",
                "96126166675243120399216293056530463967"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-75806-0554d5f0",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d",
        "target":  {
            "file":  "ssl/record/methods/tls1_meth.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "326949955695709015371510383455528221162",
                "239840320733268454235032776929266371090",
                "96126166675243120399216293056530463967"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-75806-13e74faa",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d",
        "target":  {
            "file":  "ssl/record/methods/tls1_meth.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "42592930069444457394475426079977552495",
                "169171172110014800546848721142552455883",
                "325546632989951797223265297142633362588",
                "31427437799871866777149362739144380102",
                "224380726534459472349238522492068556878",
                "180749720028175094202253730247785929194",
                "323984551179913130809380138060961820681",
                "285949712684970980586659436460741322074",
                "178598664410685207016356253417471726911",
                "246365664021454088931975811198496020922",
                "4047809462933033497120372152614856096"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-75806-1b9978ee",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972",
        "target":  {
            "file":  "test/recordlentest.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "42592930069444457394475426079977552495",
                "169171172110014800546848721142552455883",
                "325546632989951797223265297142633362588",
                "31427437799871866777149362739144380102",
                "224380726534459472349238522492068556878",
                "180749720028175094202253730247785929194",
                "323984551179913130809380138060961820681",
                "285949712684970980586659436460741322074",
                "178598664410685207016356253417471726911",
                "246365664021454088931975811198496020922",
                "4047809462933033497120372152614856096"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-75806-214762e8",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d",
        "target":  {
            "file":  "test/recordlentest.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "42592930069444457394475426079977552495",
                "169171172110014800546848721142552455883",
                "325546632989951797223265297142633362588",
                "31427437799871866777149362739144380102",
                "224380726534459472349238522492068556878",
                "180749720028175094202253730247785929194",
                "323984551179913130809380138060961820681",
                "285949712684970980586659436460741322074",
                "178598664410685207016356253417471726911",
                "246365664021454088931975811198496020922",
                "4047809462933033497120372152614856096"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-75806-381af9fb",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d",
        "target":  {
            "file":  "test/recordlentest.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "317189687872376382622237570183728297794",
            "length":  6554
        },
        "id":  "CVE-2026-75806-60f65b9a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d",
        "target":  {
            "file":  "ssl/record/methods/tls1_meth.c",
            "function":  "tls1_cipher"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "317189687872376382622237570183728297794",
            "length":  6554
        },
        "id":  "CVE-2026-75806-6524c17d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972",
        "target":  {
            "file":  "ssl/record/methods/tls1_meth.c",
            "function":  "tls1_cipher"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "326949955695709015371510383455528221162",
                "239840320733268454235032776929266371090",
                "96126166675243120399216293056530463967"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-75806-7fdf4c5a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972",
        "target":  {
            "file":  "ssl/record/methods/tls1_meth.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "326949955695709015371510383455528221162",
                "239840320733268454235032776929266371090",
                "96126166675243120399216293056530463967"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-75806-86c22d62",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d",
        "target":  {
            "file":  "ssl/record/methods/tls1_meth.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "42592930069444457394475426079977552495",
                "169171172110014800546848721142552455883",
                "325546632989951797223265297142633362588",
                "31427437799871866777149362739144380102",
                "224380726534459472349238522492068556878",
                "180749720028175094202253730247785929194",
                "323984551179913130809380138060961820681",
                "285949712684970980586659436460741322074",
                "178598664410685207016356253417471726911",
                "246365664021454088931975811198496020922",
                "4047809462933033497120372152614856096"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-75806-92c19f82",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d",
        "target":  {
            "file":  "test/recordlentest.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "273346671212057561053333047338603289094",
            "length":  286
        },
        "id":  "CVE-2026-75806-962e5b23",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d",
        "target":  {
            "file":  "test/recordlentest.c",
            "function":  "setup_tests"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "273346671212057561053333047338603289094",
            "length":  286
        },
        "id":  "CVE-2026-75806-a8c2a2b1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d",
        "target":  {
            "file":  "test/recordlentest.c",
            "function":  "setup_tests"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "28170854778703993674264004058177114599",
                "73132526844288570625317440636111911761",
                "177405411499435185068645597737938634778",
                "224809958623850711330610094965797758930",
                "295554444428855106393106961197201359586"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-75806-c377fa22",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/e04bd3433fd84e1861bf258ea37928d9845e6a86",
        "target":  {
            "file":  "include/openssl/opensslv.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "273346671212057561053333047338603289094",
            "length":  286
        },
        "id":  "CVE-2026-75806-f3da4547",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972",
        "target":  {
            "file":  "test/recordlentest.c",
            "function":  "setup_tests"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "317189687872376382622237570183728297794",
            "length":  6554
        },
        "id":  "CVE-2026-75806-f6dabed7",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d",
        "target":  {
            "file":  "ssl/record/methods/tls1_meth.c",
            "function":  "tls1_cipher"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "273346671212057561053333047338603289094",
            "length":  286
        },
        "id":  "CVE-2026-75806-f7779908",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d",
        "target":  {
            "file":  "test/recordlentest.c",
            "function":  "setup_tests"
        }
    }
]
vanir_signatures_modified 
"2026-10-20T18:21:33Z"