MGASA-2026-0353

Advisory lineage Upstream: 10 Downstream: 0
Published: 31 Aug 2026, 19:40
Last modified:31 Aug 2026, 19:56

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

31 Aug 2026, 19:40
Published
Vulnerability first disclosed
31 Aug 2026, 19:56
Last Modified
Vulnerability information updated

Description

Updated openssl packages fix security vulnerabilities Unbounded Memory Growth in QUIC Server Incoming Channel Queue. (CVE-2026-14456) QUIC Server May Trigger Double Free When Processing INITIAL Packet. (CVE-2026-18798) Heap Buffer Overflow in CMS Key Unwrapping. (CVE-2026-63072) Invalid Pointer Dereference in CMP Server via Crafted protectionAlg. (CVE-2026-63076) RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate. (CVE-2026-14457) Excessive Memory Use Buffering DTLS Records for a Future Epoch. (CVE-2026-54874) Untrusted Sender DN Used as Format String in CMP Response Validation. (CVE-2026-63073) CMP Indefinite Cache Growth of ExtraCerts. (CVE-2026-63074) QUIC ACK-only Packet Retention Can Cause Memory Exhaustion. (CVE-2026-63075)

Affected Systems

  • mageia•openssl

    < 3.5.8-1.mga10

  • mageia•openssl

    < 3.0.22-1.mga9

References (7)