PatchTheCVEopenssl vulnerabilities and fixes
Recent CVEs affecting openssl, with upgrade or downgrade steps. 14 tracked.
openssl has 14 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 14. Most recent: 2026-09-29. Highest priority: CVE-2026-84782 (score 53/100).
- CVE-2026-84784 HIGH 7.5 UPGRADE Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoidin
- CVE-2026-84783 HIGH 7.5 UPGRADE Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached
- CVE-2026-84782 HIGH 8.2 UPGRADE Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspe
- CVE-2026-77696 LOW 3.7 UPGRADE Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing s
- CVE-2026-75806 MEDIUM 5.3 UPGRADE Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single un
- CVE-2026-75805 MEDIUM 5.3 UPGRADE Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference
- CVE-2026-75804 MEDIUM 5.3 UPGRADE Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams
- CVE-2026-72897 HIGH 7.5 UPGRADE Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part wa
- CVE-2026-54875 LOW 3.7 UPGRADE Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 pri
- CVE-2026-54873 HIGH 7.5 UPGRADE Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Imp
- CVE-2026-54872 LOW 3.7 UPGRADE Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations wi
- CVE-2026-42772 MEDIUM 5.3 UPGRADE Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arri
- CVE-2026-35191 LOW 3.7 UPGRADE Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to co
- CVE-2026-35189 MEDIUM 5.3 UPGRADE Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate
FAQ
How do I fix openssl vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is openssl being exploited right now?
None of the tracked openssl CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which openssl CVE should I patch first?
CVE-2026-84782 currently ranks highest (53/100): Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspe.