MGASA-2026-0481

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0481.html
Import Source
https://advisories.mageia.org/MGASA-2026-0481.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0481
Upstream
CVE (13)
Published
2026-10-09T17:00:24Z
Modified
2026-10-09T17:28:11Z
Summary
Updated openssl package fixes security vulnerabilities
Details

DTLS Retransmits Handshake Messages From a Stale Buffer Offset. (CVE-2026-84782) Excessive Memory Allocation in Relative CRLDP Processing. (CVE-2026-35189) QUIC Unvalidated Amplification Credit may be Over Accounted. (CVE-2026-35191) Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC. (CVE-2026-42772) Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves. (CVE-2026-54872) QUIC STREAM Fragment Metadata DoS. (CVE-2026-54873) Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V. (CVE-2026-54875) Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake. (CVE-2026-72897) QUIC Connection-Level Flow Control is Not Enforced for Streams. (CVE-2026-75804) NULL Pointer Dereference in CMP Client Revocation Response Handling. (CVE-2026-75805) Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS. (CVE-2026-75806) Timing Side-Channel in SM2 Signature Generation. (CVE-2026-77696) QUIC: Unbounded RETIRE_CONNECTION_ID Backlog. (CVE-2026-84784)

References
Credits

Affected packages

Mageia:10 / openssl

Package

Name
openssl
Purl
pkg:rpm/mageia/openssl?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.5.9-1.mga10

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0481.json"