UpHeron
All vulnerabilities

Servers and applications

CVE-2026-54874

Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource…

Severity
High 7.5
Published
25 Aug 2026
Last changed
11 Sept 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.1.1zi, 3.0.22, 3.4.7, 3.5.8, 3.6.4, 4.0.2
Sources
NVD

Affected software

SoftwareAffected versions
OpenSSLServers and applications · cpe:a:openssl:openssl
  • From 4.0.0 before 4.0.2
  • From 3.6.0 before 3.6.4
  • From 3.5.0 before 3.5.8
  • From 3.4.0 before 3.4.7
All 7 release lines
  • From 1.0.2 before 1.0.2zr
  • From 1.1.1 before 1.1.1zi
  • From 3.0.0 before 3.0.22
  • From 3.4.0 before 3.4.7
  • From 3.5.0 before 3.5.8
  • From 3.6.0 before 3.6.4
  • From 4.0.0 before 4.0.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-54874
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-54874