{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "OpenSSL: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/openssl--openssl/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/openssl--openssl/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 disclosed",
   "content_text": "Issue summary: A malicious remote peer may flood the local QUIC\nstack with NEW_CONNECTION_ID frames by avoiding a limit check on\nhow many connection IDs the remote QUIC stack can use.\n\nImpact summary: The local QUIC stack sends a RETIRE_CONN_ID frame\nfor every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID\nframe is dispatched via the Control Frame Queue (CFQ). If the remote\npeer also withholds ACKs, then it can force the local stack\nto allocate ~400MB (depending on ACK delay).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism\nby which a remote peer can notify the local QUIC stack to change the\ndestination connection ID (a.k.a. CID) the local stack uses to\nidentify the connection at the remote peer. Each CID is associated\nwith a sequence number. The sequence number is transmitted\nin NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID\nwhich is being either associated with a connection or retired.\n\nThe remote peer sends a NEW_CONNECTION_ID frame to let the local stack know\na new CID is being associated with an existing connection. The\nNEW_CONNECTION_ID frame carries the new CID, its sequence number, and the\nretire-prior-to number. The retire-prior-to identifies existing\nCIDs that are to be retired. The local QUIC stack must send a\nRETIRE_CONNECTION_ID for every destination CID whose sequence number\nis less than retire-prior-to. The CID becomes retired after the\nlocal stack receives an ACK for its RETIRE_CONNECTION_ID frame.\n\nAlthough the OpenSSL QUIC stack supports at most one destination CID\nfor every connection, it can be tricked into processing more than\none RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC\nstack currently retires the destination CID as soon as it receives\nthe NEW_CONNECTION_ID, while in fact the destination CID must\nbe retired after an ACK for the RETIRE_CONNECTION_ID frame is received.\nCorrecting the flawed logic also fixes the backlog growth.\n\n[1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/alpine-v3.21",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in Alpine:v3.21",
   "content_text": "Fixed versions: openssl 3.3.7-r2.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in Debian:13",
   "content_text": "Fixed versions: openssl 3.5.7-1~deb13u3.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in Debian:14",
   "content_text": "Fixed versions: openssl 3.6.5-1.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in openSUSE:Leap 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in Red Hat:hummingbird:1",
   "content_text": "Fixed versions: openssl 0:3.5.9-0.1.hum1, openssl-config-fips 0:3.5.9-0.1.hum1, openssl-devel 0:3.5.9-0.1.hum1, openssl-devel-engine 0:3.5.9-0.1.hum1, openssl-fips-provider-upstream 0:3.5.9-0.1.hum1, openssl-libs 0:3.5.9-0.1.hum1, openssl-perl 0:3.5.9-0.1.hum1, openssl3 0:3.5.9-0.1.hum1, openssl3-devel 0:3.5.9-0.1.hum1, openssl3-devel-engine 0:3.5.9-0.1.hum1, openssl3-libs 0:3.5.9-0.1.hum1.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/suse-linux-enterprise-module-for-basesystem-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in SUSE:Linux Enterprise Module for Basesystem 15 SP7",
   "content_text": "Fixed versions: openssl-3 3.5.0-150700.5.53.2.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in SUSE:Linux Enterprise Server 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in SUSE:Linux Enterprise Server for SAP applications 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/suse-linux-micro-6.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in SUSE:Linux Micro 6.2",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in Ubuntu:22.04:LTS",
   "content_text": "Fixed versions: openssl 3.0.2-0ubuntu1.30.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in Ubuntu:24.04:LTS",
   "content_text": "Fixed versions: openssl 3.0.13-0ubuntu3.16.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84784/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84784/",
   "title": "CVE-2026-84784 fixed in Ubuntu:26.04:LTS",
   "content_text": "Fixed versions: openssl 3.5.5-1ubuntu3.6.",
   "date_published": "2026-09-29T15:32:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84783/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84783/",
   "title": "CVE-2026-84783 disclosed",
   "content_text": "Issue summary: The first concurrent use of the same X.509 certificate by\nseveral threads may cause its cached extension data to be freed while\nanother thread is still using it.\n\nImpact summary: A remote, unauthenticated peer could crash a multi-threaded\nTLS client, or a multi-threaded TLS server that requests client\ncertificates, if the first certificate chains built to the same trusted CA\ncertificate are built by several connections at the same time. This is a\nuse-after-free read, which is likely to crash the process, resulting in a\nDenial of Service.\n\nCWE: CWE-416: Use After Free\n\nDescription: OpenSSL caches the decoded values of a certificate's X.509v3\nextensions inside the X509 object the first time they are needed. In\nOpenSSL 4.0 this cache is built in two phases: the extension values are\ncomputed while holding a read lock on the certificate, and the results are\nthen installed into the certificate under a write lock. Because a read lock\ndoes not exclude other readers, several threads can compute the cache for\nthe same certificate at the same time. Each thread that subsequently\nacquires the write lock installs its own results and frees the values\ninstalled by the thread before it, even though that earlier thread has\nalready marked the cache as complete and may have returned pointers into it\nto its caller. A caller still using those pointers then reads freed memory.\n\nAny certificate shared between threads is exposed the first time its\nextensions are decoded. In TLS the certificates at risk are the trusted CA\ncertificates supplied for chain verification, by whatever means, since these\nare shared by every connection and their extensions are decoded and cached\nthe first time a chain is built to them. Certificates sent by the peer are\ndecoded separately for each connection and are not shared, so they are not\naffected. In a TLS client verifying server certificates, or a TLS server\nthat requests and verifies client certificates, the use-after-free could\nonly occur if the first chains built to the same trusted CA are built by\nseveral connections at the same time.\n\nFIPS impact: no\nThe FIPS module is not affected as X.509 certificate handling is outside\nof the OpenSSL FIPS module boundary.\n\nOpenSSL 4.0 is vulnerable to this issue.\n\nOpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\n\nThis issue was reported on 27 August 2026 by Tim Becker (Xint.io) and\nindependently in a public report on 31 August 2026 by aydinmercan.\n\nThe fix has been developed by Bob Beck.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Tim Becker (Xint.io), aydinmercan\nFixed by: Bob Beck",
   "date_published": "2026-09-29T15:32:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84783/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84783/",
   "title": "CVE-2026-84783 fixed in Red Hat:hummingbird:1",
   "content_text": "Fixed versions: openssl 0:3.5.8-0.1.hum1, openssl-config-fips 0:3.5.8-0.1.hum1, openssl-devel 0:3.5.8-0.1.hum1, openssl-devel-engine 0:3.5.8-0.1.hum1, openssl-fips-provider-upstream 0:3.5.8-0.1.hum1, openssl-libs 0:3.5.8-0.1.hum1, openssl-perl 0:3.5.8-0.1.hum1, openssl3 0:3.5.8-1.hum1, openssl3-devel 0:3.5.8-1.hum1, openssl3-devel-engine 0:3.5.8-1.hum1, openssl3-libs 0:3.5.8-1.hum1.",
   "date_published": "2026-09-29T15:32:24Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 disclosed",
   "content_text": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/almalinux-10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in AlmaLinux:10",
   "content_text": "Fixed versions: openssl 1:3.5.8-2.el10_2.alma.1, openssl-devel 1:3.5.8-2.el10_2.alma.1, openssl-libs 1:3.5.8-2.el10_2.alma.1, openssl-perl 1:3.5.8-2.el10_2.alma.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/almalinux-8",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in AlmaLinux:8",
   "content_text": "Fixed versions: compat-openssl10 1:1.0.2o-4.el8_10.4, openssl 1:1.1.1k-18.el8_6, openssl-devel 1:1.1.1k-18.el8_6, openssl-libs 1:1.1.1k-18.el8_6, openssl-perl 1:1.1.1k-18.el8_6.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/almalinux-9",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in AlmaLinux:9",
   "content_text": "Fixed versions: compat-openssl11 1:1.1.1k-5.el9_8.6, openssl 1:3.5.8-2.el9_8, openssl-devel 1:3.5.8-2.el9_8, openssl-libs 1:3.5.8-2.el9_8, openssl-perl 1:3.5.8-2.el9_8.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/alpine-v3.21",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Alpine:v3.21",
   "content_text": "Fixed versions: openssl 3.3.7-r2.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Debian:13",
   "content_text": "Fixed versions: openssl 3.5.7-1~deb13u3.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Debian:14",
   "content_text": "Fixed versions: openssl 3.6.5-1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in openSUSE:Leap 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/red-hat-enterprise-linux-10.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Red Hat:enterprise_linux:10.2",
   "content_text": "Fixed versions: openssl 1:3.5.8-2.el10_2, openssl-debuginfo 1:3.5.8-2.el10_2, openssl-debugsource 1:3.5.8-2.el10_2, openssl-devel 1:3.5.8-2.el10_2, openssl-libs 1:3.5.8-2.el10_2, openssl-libs-debuginfo 1:3.5.8-2.el10_2, openssl-perl 1:3.5.8-2.el10_2.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/red-hat-enterprise-linux-8",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Red Hat:enterprise_linux:8",
   "content_text": "Fixed versions: compat-openssl10 1:1.0.2o-4.el8_10.4, compat-openssl10-debuginfo 1:1.0.2o-4.el8_10.4, compat-openssl10-debugsource 1:1.0.2o-4.el8_10.4.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/red-hat-enterprise-linux-9",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Red Hat:enterprise_linux:9",
   "content_text": "Fixed versions: compat-openssl11 1:1.1.1k-5.el9_8.6, compat-openssl11-debuginfo 1:1.1.1k-5.el9_8.6, compat-openssl11-debugsource 1:1.1.1k-5.el9_8.6, openssl 1:3.5.8-2.el9_8, openssl-debuginfo 1:3.5.8-2.el9_8, openssl-debugsource 1:3.5.8-2.el9_8, openssl-devel 1:3.5.8-2.el9_8, openssl-libs 1:3.5.8-2.el9_8, openssl-libs-debuginfo 1:3.5.8-2.el9_8, openssl-perl 1:3.5.8-2.el9_8.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Red Hat:hummingbird:1",
   "content_text": "Fixed versions: bootupd 0:0.3.2-1.hum1, chunkah 0:0.7.0-1.1.hum1, openssl 0:3.5.9-0.1.hum1, openssl-config-fips 0:3.5.9-0.1.hum1, openssl-devel 0:3.5.9-0.1.hum1, openssl-devel-engine 0:3.5.9-0.1.hum1, openssl-fips-provider-upstream 0:3.5.9-0.1.hum1, openssl-libs 0:3.5.9-0.1.hum1, openssl-perl 0:3.5.9-0.1.hum1, openssl3 0:3.5.9-0.1.hum1, openssl3-devel 0:3.5.9-0.1.hum1, openssl3-devel-engine 0:3.5.9-0.1.hum1, openssl3-libs 0:3.5.9-0.1.hum1, python-cryptography 0:50.0.0-1.hum1, python3-cryptography 0:50.0.0-1.hum1, ruby3.3 0:3.3.10-23.6.hum1, ruby3.3-bundled-gems 0:3.3.10-23.6.hum1, ruby3.3-default-gems 0:3.3.10-23.6.hum1, ruby3.3-devel 0:3.3.10-23.6.hum1, ruby3.3-doc 0:3.3.10-23.6.hum1, ruby3.3-libs 0:3.3.10-23.6.hum1, ruby3.4 0:3.4.10-31.7.hum1, ruby3.4-bundled-gems 0:3.4.10-31.7.hum1, ruby3.4-default-gems 0:3.4.10-31.7.hum1, ruby3.4-devel 0:3.4.10-31.7.hum1, ruby3.4-doc 0:3.4.10-31.7.hum1, ruby3.4-libs 0:3.4.10-31.7.hum1, rubygem3.3-bigdecimal 0:3.1.5-23.6.hum1, rubygem3.3-bundler 0:2.5.22-23.6.hum1, rubygem3.3-devel 0:3.5.22-23.6.hum1, rubygem3.3-io-console 0:0.7.1-23.6.hum1, rubygem3.3-irb 0:1.13.1-23.6.hum1, rubygem3.3-json 0:2.7.2-23.6.hum1, rubygem3.3-minitest 0:5.20.0-23.6.hum1, rubygem3.3-power_assert 0:2.0.3-23.6.hum1, rubygem3.3-psych 0:5.1.2-23.6.hum1, rubygem3.3-racc 0:1.7.3-23.6.hum1, rubygem3.3-rake 0:13.1.0-23.6.hum1, rubygem3.3-rbs 0:3.4.0-23.6.hum1, rubygem3.3-rdoc 0:6.6.3.1-23.6.hum1, rubygem3.3-rexml 0:3.4.4-23.6.hum1, rubygem3.3-rss 0:0.3.1-23.6.hum1, rubygem3.3-rubygems 0:3.5.22-23.6.hum1, rubygem3.3-test-unit 0:3.6.1-23.6.hum1, rubygem3.3-typeprof 0:0.21.9-23.6.hum1, rust-bootupd 0:0.3.2-1.hum1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/rocky-linux-10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Rocky Linux:10",
   "content_text": "Fixed versions: openssl 1:3.5.8-2.el10_2.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/rocky-linux-8",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Rocky Linux:8",
   "content_text": "Fixed versions: compat-openssl10 1:1.0.2o-4.el8_10.4.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/rocky-linux-9",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Rocky Linux:9",
   "content_text": "Fixed versions: compat-openssl11 1:1.1.1k-5.el9_8.6, openssl 1:3.5.8-2.el9_8.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150500.5.80.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150500.5.80.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-live-patching-15-sp6",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Live Patching 15 SP6",
   "content_text": "Fixed versions: openssl-3-livepatches 0.7-150600.13.22.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-live-patching-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Live Patching 15 SP7",
   "content_text": "Fixed versions: openssl-3-livepatches 0.7-150700.16.15.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-micro-5.3",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Micro 5.3",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-micro-5.4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Micro 5.4",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-module-for-basesystem-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Module for Basesystem 15 SP7",
   "content_text": "Fixed versions: openssl-3 3.5.0-150700.5.53.2.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server 15 SP4-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server 15 SP5-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150500.5.80.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-15-sp6-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server 15 SP6-LTSS",
   "content_text": "Fixed versions: openssl-3 3.1.4-150600.5.67.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server for SAP Applications 15 SP4",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server for SAP Applications 15 SP5",
   "content_text": "Fixed versions: openssl-3 3.0.8-150500.5.80.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp6",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server for SAP Applications 15 SP6",
   "content_text": "Fixed versions: openssl-3 3.1.4-150600.5.67.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Enterprise Server for SAP applications 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-micro-6.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Micro 6.0",
   "content_text": "Fixed versions: openssl-3 3.1.4-159998.1.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/suse-linux-micro-6.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in SUSE:Linux Micro 6.2",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Ubuntu:22.04:LTS",
   "content_text": "Fixed versions: openssl 3.0.2-0ubuntu1.30.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Ubuntu:24.04:LTS",
   "content_text": "Fixed versions: openssl 3.0.13-0ubuntu3.16.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Ubuntu:26.04:LTS",
   "content_text": "Fixed versions: openssl 3.5.5-1ubuntu3.6.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/ubuntu-pro-14.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Ubuntu:Pro:14.04:LTS",
   "content_text": "Fixed versions: openssl 1.0.1f-1ubuntu2.27+esm17.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Ubuntu:Pro:16.04:LTS",
   "content_text": "Fixed versions: openssl 1.0.2g-1ubuntu4.20+esm19.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Ubuntu:Pro:18.04:LTS",
   "content_text": "Fixed versions: openssl 1.1.1-1ubuntu2.1~18.04.23+esm11, openssl1.0 1.0.2n-1ubuntu5.13+esm7.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-84782/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-84782/",
   "title": "CVE-2026-84782 fixed in Ubuntu:Pro:20.04:LTS",
   "content_text": "Fixed versions: openssl 1.1.1f-1ubuntu2.24+esm6.",
   "date_published": "2026-09-29T15:32:23Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 disclosed",
   "content_text": "Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/alpine-v3.21",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in Alpine:v3.21",
   "content_text": "Fixed versions: openssl 3.3.7-r2.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in Debian:13",
   "content_text": "Fixed versions: openssl 3.5.7-1~deb13u3.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in Debian:14",
   "content_text": "Fixed versions: openssl 3.6.5-1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in openSUSE:Leap 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in Red Hat:hummingbird:1",
   "content_text": "Fixed versions: openssl 0:3.5.9-0.1.hum1, openssl-config-fips 0:3.5.9-0.1.hum1, openssl-devel 0:3.5.9-0.1.hum1, openssl-devel-engine 0:3.5.9-0.1.hum1, openssl-fips-provider-upstream 0:3.5.9-0.1.hum1, openssl-libs 0:3.5.9-0.1.hum1, openssl-perl 0:3.5.9-0.1.hum1, openssl3 0:3.5.9-0.1.hum1, openssl3-devel 0:3.5.9-0.1.hum1, openssl3-devel-engine 0:3.5.9-0.1.hum1, openssl3-libs 0:3.5.9-0.1.hum1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150500.5.80.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150500.5.80.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-micro-5.3",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise Micro 5.3",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-micro-5.4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise Micro 5.4",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-module-for-basesystem-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise Module for Basesystem 15 SP7",
   "content_text": "Fixed versions: openssl-3 3.5.0-150700.5.53.2.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-server-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise Server 15 SP4-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-server-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise Server 15 SP5-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150500.5.80.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-server-15-sp6-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise Server 15 SP6-LTSS",
   "content_text": "Fixed versions: openssl-3 3.1.4-150600.5.67.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise Server 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise Server for SAP Applications 15 SP4",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise Server for SAP Applications 15 SP5",
   "content_text": "Fixed versions: openssl-3 3.0.8-150500.5.80.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp6",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise Server for SAP Applications 15 SP6",
   "content_text": "Fixed versions: openssl-3 3.1.4-150600.5.67.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Enterprise Server for SAP applications 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-micro-6.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Micro 6.0",
   "content_text": "Fixed versions: openssl-3 3.1.4-159998.1.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/suse-linux-micro-6.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in SUSE:Linux Micro 6.2",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in Ubuntu:22.04:LTS",
   "content_text": "Fixed versions: openssl 3.0.2-0ubuntu1.30.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in Ubuntu:24.04:LTS",
   "content_text": "Fixed versions: openssl 3.0.13-0ubuntu3.16.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in Ubuntu:26.04:LTS",
   "content_text": "Fixed versions: openssl 3.5.5-1ubuntu3.6.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/ubuntu-pro-14.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in Ubuntu:Pro:14.04:LTS",
   "content_text": "Fixed versions: openssl 1.0.1f-1ubuntu2.27+esm17.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in Ubuntu:Pro:16.04:LTS",
   "content_text": "Fixed versions: openssl 1.0.2g-1ubuntu4.20+esm19.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in Ubuntu:Pro:18.04:LTS",
   "content_text": "Fixed versions: openssl 1.1.1-1ubuntu2.1~18.04.23+esm11, openssl1.0 1.0.2n-1ubuntu5.13+esm7.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77696/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77696/",
   "title": "CVE-2026-77696 fixed in Ubuntu:Pro:20.04:LTS",
   "content_text": "Fixed versions: openssl 1.1.1f-1ubuntu2.24+esm6.",
   "date_published": "2026-09-29T15:32:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75806/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75806/",
   "title": "CVE-2026-75806 disclosed",
   "content_text": "Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.",
   "date_published": "2026-09-29T15:32:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75806/fixed/alpine-v3.21",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75806/",
   "title": "CVE-2026-75806 fixed in Alpine:v3.21",
   "content_text": "Fixed versions: openssl 3.3.7-r2.",
   "date_published": "2026-09-29T15:32:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75806/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75806/",
   "title": "CVE-2026-75806 fixed in Debian:13",
   "content_text": "Fixed versions: openssl 3.5.7-1~deb13u3.",
   "date_published": "2026-09-29T15:32:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75806/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75806/",
   "title": "CVE-2026-75806 fixed in Debian:14",
   "content_text": "Fixed versions: openssl 3.6.5-1.",
   "date_published": "2026-09-29T15:32:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75806/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75806/",
   "title": "CVE-2026-75806 fixed in openSUSE:Leap 16.0",
   "content_text": "Fixed versions: openssl-3 3.5.0-160000.11.1.",
   "date_published": "2026-09-29T15:32:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75806/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75806/",
   "title": "CVE-2026-75806 fixed in Red Hat:hummingbird:1",
   "content_text": "Fixed versions: openssl 0:3.5.9-0.1.hum1, openssl-config-fips 0:3.5.9-0.1.hum1, openssl-devel 0:3.5.9-0.1.hum1, openssl-devel-engine 0:3.5.9-0.1.hum1, openssl-fips-provider-upstream 0:3.5.9-0.1.hum1, openssl-libs 0:3.5.9-0.1.hum1, openssl-perl 0:3.5.9-0.1.hum1, openssl3 0:3.5.9-0.1.hum1, openssl3-devel 0:3.5.9-0.1.hum1, openssl3-devel-engine 0:3.5.9-0.1.hum1, openssl3-libs 0:3.5.9-0.1.hum1.",
   "date_published": "2026-09-29T15:32:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75806/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75806/",
   "title": "CVE-2026-75806 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75806/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75806/",
   "title": "CVE-2026-75806 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75806/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75806/",
   "title": "CVE-2026-75806 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150500.5.80.1.",
   "date_published": "2026-09-29T15:32:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75806/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75806/",
   "title": "CVE-2026-75806 fixed in SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150500.5.80.1.",
   "date_published": "2026-09-29T15:32:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75806/fixed/suse-linux-enterprise-micro-5.3",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75806/",
   "title": "CVE-2026-75806 fixed in SUSE:Linux Enterprise Micro 5.3",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75806/fixed/suse-linux-enterprise-micro-5.4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75806/",
   "title": "CVE-2026-75806 fixed in SUSE:Linux Enterprise Micro 5.4",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75806/fixed/suse-linux-enterprise-module-for-basesystem-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75806/",
   "title": "CVE-2026-75806 fixed in SUSE:Linux Enterprise Module for Basesystem 15 SP7",
   "content_text": "Fixed versions: openssl-3 3.5.0-150700.5.53.2.",
   "date_published": "2026-09-29T15:32:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75806/fixed/suse-linux-enterprise-server-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75806/",
   "title": "CVE-2026-75806 fixed in SUSE:Linux Enterprise Server 15 SP4-LTSS",
   "content_text": "Fixed versions: openssl-3 3.0.8-150400.4.101.1.",
   "date_published": "2026-09-29T15:32:21Z"
  }
 ]
}