INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Memory

| 2026-09-30 06:55 CRITICAL LOW VULNERABILITY DISCLOSURE
JSON
Executive Summary
AI-generated
A high-severity OpenSSL flaw, tracked as CVE-2026-84782, was discovered on August 17 and fixed in versions 4.0.3, 3.6.5, 3.5.9, and 3.4.8 by September 30. The vulnerability affects software using OpenSSL for DTLS, potentially leaking heap memory to the other side of a connection or causing a crash when sending a resend message while another part of the handshake is stuck. As of September 29, CISA gave the flaw a CVSS score of 8.2 out of 10, rating its impact on confidentiality Low and availability High; no exploitation was reported at that time. The affected software versions include OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, with fixed versions available for some branches only to customers who pay for premium support; the flaw does not limit itself to DTLS clients or servers.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-89102, CVE-2026-84782 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-89102CVE-2026-89102 CVE-2026-84782CVE-2026-84782 CVE-2026-75806CVE-2026-75806 CVE-2026-93302CVE-2026-93302 CVE-2026-89136CVE-2026-89136 CVE-2026-84783CVE-2026-84783
Target & Sectors
Global Scope
Incident Timeline
‎August 17
Laurent Gaffie of Secorizon reported a high-severity vulnerability in OpenSSL and WolfSSL on August 17.
‎August 25
OpenSSL 3.0 users who installed the August 25, 2022 public release (version 3.0.22) are advised to apply available patches for high-severity vulnerabilities.
infrastructure 3.0
What OpenSSL 3.0 Users Can Do The last public 3.0 release was 3.0.22 , on August 25.
general_metric 3.0 OpenSSL
What OpenSSL 3.0 Users Can Do The last public 3.0 release was 3.0.22 , on August 25.
infrastructure 3.0.22
What OpenSSL 3.0 Users Can Do The last public 3.0 release was 3.0.22 , on August 25.
victims 3.0 Users
What OpenSSL 3.0 Users Can Do The last public 3.0 release was 3.0.22 , on August 25.
‎September 7, 2026
Public support for OpenSSL version 1.1.1zj ended on September 7, 2026.
infrastructure 1.1.1
…8, 2030 3.4 3.4.8 Public download Supported until October 22, 2026 3.0 3.0.23 Premium support customers only Public support ended September 7, 2026 1.1.1 1.1.1zj Premium support customers
infrastructure 1.1
…8, 2030 3.4 3.4.8 Public download Supported until October 22, 2026 3.0 3.0.23 Premium support customers only Public support ended September 7, 2026 1.1.1 1.1.1zj Premium support customers
‎September 7
OpenSSL 3.0 stopped receiving public security fixes on September 7, marking the end of its support period.
general_metric 3.0 OpenSSL
OpenSSL 3.0 stopped getting public security fixes on September 7. OpenSSL has not said whether an attacker can cause a resend while a message is stuck, nor has it reported any attacks exploiting the flaw.
‎September 25
WolfSSL developers released version 5.9.4 on September 25, addressing high-severity vulnerabilities in the software.
infrastructure 5.9.4
WolfSSL security patches WolfSSL developers released version 5.9.4 on September 25.
‎September 29
Threat actors did not explicitly target any entities in the provided snippet, but a High-severity OpenSSL flaw (CVE-2026-84782) was disclosed on September 29.
vulnerability CVSS score of 8.2
CISA gave the flaw a CVSS score of 8.2 out of 10 on September 29, rating its impact on confidentiality Low and on availability High.
infrastructure 26.04
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
infrastructure 3.5.5-1ubuntu3
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
infrastructure 24.04
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
infrastructure 3.0.13-0ubuntu3
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
infrastructure 22.04
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
infrastructure 3.0.2-0ubuntu1
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
general_metric 26.04 Ubuntu LTS
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
general_metric 24.04 libssl3t64 Ubuntu LTS
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
general_metric 22.04 LTS
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
vulnerability CVE-2026-84782
It fixes 6 of the 14 flaws disclosed on September 29, including CVE-2026-84782.
general_metric 14 vulnerabilities
It fixes 6 of the 14 flaws disclosed on September 29, including CVE-2026-84782.
general_metric 6 Entities
It fixes 6 of the 14 flaws disclosed on September 29, including CVE-2026-84782.
general_metric 13 Debian
The September 29 releases fix 13 other flaws.
‎September 30
Debian 12 remained listed as vulnerable to high-severity vulnerabilities in OpenSSL and WolfSSL until at least September 30.
general_metric 12 Debian
Its security tracker still listed Debian 12 as vulnerable as of 07:36 UTC on September 30.
‎2026/09/30
Threat actors could exploit the DTLS 1.2 vulnerability, CVE-2026-84782, to crash a multi-threaded TLS client and cause a denial-of-service (DoS) condition by sending data that is accepted as authentic through an AEAD cipher suite in established connections using Raw Public Key support enabled by selecting an RPK certificate type the client never requested.
organisation CRL
The four low-severity bugs could lead to a use-after-free during connection shutdown, skipped CRL revocation checks, acceptance of certificates with invalid signatures, and server impersonation.
organisation DTLS
Tracked as CVE-2026-84782, it could allow a remote peer to obtain fragments of heap memory or crash applications that use Datagram TLS (DTLS), a protocol commonly found in VPNs, VoIP and IoT products.
DTLS is used, for example, to protect WebRTC data channels and to set up encryption keys for internet calls.
organisation IoT
Tracked as CVE-2026-84782, it could allow a remote peer to obtain fragments of heap memory or crash applications that use Datagram TLS (DTLS), a protocol commonly found in VPNs, VoIP and IoT products.
infrastructure 4.0.3
The flaw, tracked as CVE-2026-84782, is fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8 .
Branch Fixed version Who can get it Support status 4.0 4.0.3 Public download Supported until May 14, 2027 3.6 3.6.5 Public download Supported until November 1, 2026 3.5…
infrastructure 3.6.5
The flaw, tracked as CVE-2026-84782, is fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8 .
…Support status 4.0 4.0.3 Public download Supported until May 14, 2027 3.6 3.6.5 Public download Supported until November 1, 2026 3.5 3.5.9 Public download Long-t…
infrastructure 3.5.9
The flaw, tracked as CVE-2026-84782, is fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8 .
…until May 14, 2027 3.6 3.6.5 Public download Supported until November 1, 2026 3.5 3.5.9 Public download Long-term support release, supported until April 8, 2030 3.4 3.4.8 Public download…
infrastructure 3.4.8
The flaw, tracked as CVE-2026-84782, is fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8 .
…3.5 3.5.9 Public download Long-term support release, supported until April 8, 2030 3.4 3.4.8 Public download Supported until October 22, 2026 3.0 3.0.23 Premium support customers only…
organisation CVSS
The issue has a CVSS score of 8.2 and can be exploited over the network without authentication or user interaction.
OpenSSL does not use CVSS to set its severity ratings and says scores from outside parties can differ greatly from them.
organisation CVE-2026
CVE-2026-89102 allows an attacker holding any certificate (and its private key) that chains to a CA trusted by the client to forge certificates for arbitrary identities.
organisation Raw Public Key
CVE-2026-89136 lets a malicious server bypass authentication on clients with Raw Public Key support enabled by selecting an RPK certificate type the client never requested.
organisation RPK
CVE-2026-89136 lets a malicious server bypass authentication on clients with Raw Public Key support enabled by selecting an RPK certificate type the client never requested.
organisation DoS
If the read reaches unmapped memory, the application crashes, resulting in a denial-of-service (DoS) condition.
organisation TLS
A remote, unauthenticated peer could exploit the weakness to crash a multi-threaded TLS client and cause a DoS condition.
DTLS , the TLS variant used for UDP traffic, resends a handshake message if no reply arrives before the timer expires.
organisation UDP
DTLS , the TLS variant used for UDP traffic, resends a handshake message if no reply arrives before the timer expires.
organisation CPU
They mostly lead to DoS conditions, caused by excessive memory or CPU consumption, process crashes, or the termination of DTLS 1.2 connections.
organisation AEAD
It affects established DTLS 1.2 connections that use an AEAD cipher suite.
organisation Nginx
Affected builds include those created for integration with Nginx, HAProxy, Stunnel, Apache httpd, and other applications.
organisation HAProxy
Affected builds include those created for integration with Nginx, HAProxy, Stunnel, Apache httpd, and other applications.
organisation Stunnel
Affected builds include those created for integration with Nginx, HAProxy, Stunnel, Apache httpd, and other applications.
organisation API
Most require specific configurations or legacy API usage.
infrastructure 4.0
Branch Fixed version Who can get it Support status 4.0 4.0.3 Public download Supported until May 14, 2027 3.6 3.6.5 Public download Supported until November 1, 2026 3.5…
Which Versions Fix the Flaw The flaw affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, in every release before the fixed version shown below.
OpenSSL recommends upgrading to a newer branch, such as 4.0 or the long-term support release 3.5.
infrastructure 3.0
Fixed versions for the older 3.0, 1.1.1 and 1.0.2 branches go only to customers who pay for OpenSSL's premium support.
Which Versions Fix the Flaw The flaw affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, in every release before the fixed version shown below.
…rt release, supported until April 8, 2030 3.4 3.4.8 Public download Supported until October 22, 2026 3.0 3.0.23 Premium support customers only Public support ended September 7, 2026 1.1.1 1.1.1zj…
Version 3.0.23 is the first 3.0 security release that OpenSSL has not made public.
Anyone who builds OpenSSL 3.0 or ships a copy inside their own software has no public fix from OpenSSL.
infrastructure 1.1.1
Fixed versions for the older 3.0, 1.1.1 and 1.0.2 branches go only to customers who pay for OpenSSL's premium support.
Which Versions Fix the Flaw The flaw affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, in every release before the fixed version shown below.
infrastructure 1.0.2
Fixed versions for the older 3.0, 1.1.1 and 1.0.2 branches go only to customers who pay for OpenSSL's premium support.
Which Versions Fix the Flaw The flaw affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, in every release before the fixed version shown below.
infrastructure 3.6
Which Versions Fix the Flaw The flaw affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, in every release before the fixed version shown below.
…o can get it Support status 4.0 4.0.3 Public download Supported until May 14, 2027 3.6 3.6.5 Public download Supported until November 1, 2026 3.5 3.5.9 Public download…
infrastructure 3.5
Which Versions Fix the Flaw The flaw affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, in every release before the fixed version shown below.
OpenSSL recommends upgrading to a newer branch, such as 4.0 or the long-term support release 3.5.
…Supported until May 14, 2027 3.6 3.6.5 Public download Supported until November 1, 2026 3.5 3.5.9 Public download Long-term support release, supported until April 8, 2030 3.4 3.4.8…
infrastructure 3.4
Which Versions Fix the Flaw The flaw affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, in every release before the fixed version shown below.
…November 1, 2026 3.5 3.5.9 Public download Long-term support release, supported until April 8, 2030 3.4 3.4.8 Public download Supported until October 22, 2026 3.0 3.0.23 Premium support c…
infrastructure 3.0.23
Version 3.0.23 is the first 3.0 security release that OpenSSL has not made public.
…until April 8, 2030 3.4 3.4.8 Public download Supported until October 22, 2026 3.0 3.0.23 Premium support customers only Public support ended September 7, 2026 1.1.1 1.1.1zj Premium suppor…
infrastructure 3.5.7-1
Debian fixed the flaw in Debian 13 with version 3.5.7-1~deb13u3 of its openssl package, released as DSA-6531-1 .
financial 1 DSA-6531
Debian fixed the flaw in Debian 13 with version 3.5.7-1~deb13u3 of its openssl package, released as DSA-6531-1 .
organisation Ubuntu
Ubuntu's security notice says an attacker could possibly use the flaw to cause "incorrect handshake behavior or a denial of service."
‎October 22, 2026
The OpenSSL project released a new long-term support version, 3.4.8, which is publicly available for download and supported until October 22, 2026.
‎November 1, 2026
The OpenSSL and WolfSSL libraries were made publicly available for download, with specific versions supported until November 1, 2026.
‎May 14, 2027
The OpenSSL and WolfSSL libraries have been patched with a new version, 4.0.3 for the former and 3.6.5 for the latter, which are publicly available for download until May 14, 2027 and November 1, 2026 respectively.
‎April 8, 2030
The OpenSSL and WolfSSL projects released a long-term support version, supported until April 8, 2030.
Tactical Metrics
Metrics
infrastructure
‎5.9.4
Software Version
WolfSSL security patches WolfSSL developers released version 5.9.4 on September 25.
Metrics
infrastructure
‎4.0.3
Software Version
The flaw, tracked as CVE-2026-84782, is fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8 .
Branch Fixed version Who can get it Support status 4.0 4.0.3 Public download Supported until May 14, 2027 3.6 3.6.5 Public download Supported until November 1, 2026 3.5…
Metrics
infrastructure
‎3.6.5
Software Version
The flaw, tracked as CVE-2026-84782, is fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8 .
…Support status 4.0 4.0.3 Public download Supported until May 14, 2027 3.6 3.6.5 Public download Supported until November 1, 2026 3.5 3.5.9 Public download Long-t…
Metrics
infrastructure
‎3.5.9
Software Version
The flaw, tracked as CVE-2026-84782, is fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8 .
…until May 14, 2027 3.6 3.6.5 Public download Supported until November 1, 2026 3.5 3.5.9 Public download Long-term support release, supported until April 8, 2030 3.4 3.4.8 Public download…
Metrics
infrastructure
‎3.4.8
Software Version
The flaw, tracked as CVE-2026-84782, is fixed in OpenSSL 4.0.3, 3.6.5, 3.5.9 and 3.4.8 .
…3.5 3.5.9 Public download Long-term support release, supported until April 8, 2030 3.4 3.4.8 Public download Supported until October 22, 2026 3.0 3.0.23 Premium support customers only…
Metrics
infrastructure
‎3.0
Software Version
Fixed versions for the older 3.0, 1.1.1 and 1.0.2 branches go only to customers who pay for OpenSSL's premium support.
Which Versions Fix the Flaw The flaw affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, in every release before the fixed version shown below.
…rt release, supported until April 8, 2030 3.4 3.4.8 Public download Supported until October 22, 2026 3.0 3.0.23 Premium support customers only Public support ended September 7, 2026 1.1.1 1.1.1zj…
What OpenSSL 3.0 Users Can Do The last public 3.0 release was 3.0.22 , on August 25.
Version 3.0.23 is the first 3.0 security release that OpenSSL has not made public.
Anyone who builds OpenSSL 3.0 or ships a copy inside their own software has no public fix from OpenSSL.
Metrics
infrastructure
‎1.1.1
Software Version
Fixed versions for the older 3.0, 1.1.1 and 1.0.2 branches go only to customers who pay for OpenSSL's premium support.
Which Versions Fix the Flaw The flaw affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, in every release before the fixed version shown below.
…8, 2030 3.4 3.4.8 Public download Supported until October 22, 2026 3.0 3.0.23 Premium support customers only Public support ended September 7, 2026 1.1.1 1.1.1zj Premium support customers
Metrics
infrastructure
‎1.0.2
Software Version
Fixed versions for the older 3.0, 1.1.1 and 1.0.2 branches go only to customers who pay for OpenSSL's premium support.
Which Versions Fix the Flaw The flaw affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, in every release before the fixed version shown below.
Metrics
infrastructure
‎4.0
Software Version
Which Versions Fix the Flaw The flaw affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, in every release before the fixed version shown below.
Branch Fixed version Who can get it Support status 4.0 4.0.3 Public download Supported until May 14, 2027 3.6 3.6.5 Public download Supported until November 1, 2026 3.5…
OpenSSL recommends upgrading to a newer branch, such as 4.0 or the long-term support release 3.5.
Metrics
infrastructure
‎3.6
Software Version
Which Versions Fix the Flaw The flaw affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, in every release before the fixed version shown below.
…o can get it Support status 4.0 4.0.3 Public download Supported until May 14, 2027 3.6 3.6.5 Public download Supported until November 1, 2026 3.5 3.5.9 Public download…
Metrics
infrastructure
‎3.5
Software Version
Which Versions Fix the Flaw The flaw affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, in every release before the fixed version shown below.
…Supported until May 14, 2027 3.6 3.6.5 Public download Supported until November 1, 2026 3.5 3.5.9 Public download Long-term support release, supported until April 8, 2030 3.4 3.4.8…
OpenSSL recommends upgrading to a newer branch, such as 4.0 or the long-term support release 3.5.
Metrics
infrastructure
‎3.4
Software Version
Which Versions Fix the Flaw The flaw affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, in every release before the fixed version shown below.
…November 1, 2026 3.5 3.5.9 Public download Long-term support release, supported until April 8, 2030 3.4 3.4.8 Public download Supported until October 22, 2026 3.0 3.0.23 Premium support c…
Metrics
infrastructure
‎3.0.23
Software Version
…until April 8, 2030 3.4 3.4.8 Public download Supported until October 22, 2026 3.0 3.0.23 Premium support customers only Public support ended September 7, 2026 1.1.1 1.1.1zj Premium suppor…
Version 3.0.23 is the first 3.0 security release that OpenSSL has not made public.
Metrics
infrastructure
‎1.1
Software Version
…8, 2030 3.4 3.4.8 Public download Supported until October 22, 2026 3.0 3.0.23 Premium support customers only Public support ended September 7, 2026 1.1.1 1.1.1zj Premium support customers
Metrics
infrastructure
‎26.04
Software Version
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
Metrics
infrastructure
‎3.5.5-1ubuntu3
Software Version
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
Metrics
infrastructure
‎24.04
Software Version
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
Metrics
infrastructure
‎3.0.13-0ubuntu3
Software Version
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
Metrics
infrastructure
‎22.04
Software Version
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
Metrics
infrastructure
‎3.0.2-0ubuntu1
Software Version
Ubuntu fixed the flaw on September 29 in its own packages, which keep older OpenSSL version numbers: Ubuntu 26.04 LTS: libssl3t64 3.5.5-1ubuntu3.6 Ubuntu 24.04 LTS: libssl3t64 3.0.13-0ubuntu3.16 Ubuntu 22.04 LTS: libssl3 3.0.2-0ubuntu1.30 Ubuntu users need to reboot after the update for all the changes to take effect.
Metrics
infrastructure
‎3.5.7-1
Software Version
Debian fixed the flaw in Debian 13 with version 3.5.7-1~deb13u3 of its openssl package, released as DSA-6531-1 .
Metrics
financial
1
Dsa-6531
Debian fixed the flaw in Debian 13 with version 3.5.7-1~deb13u3 of its openssl package, released as DSA-6531-1 .
Metrics
infrastructure
‎3.0.22
Software Version
What OpenSSL 3.0 Users Can Do The last public 3.0 release was 3.0.22 , on August 25.
Metrics
victims
3
Users
What OpenSSL 3.0 Users Can Do The last public 3.0 release was 3.0.22 , on August 25.
Intelligence Sources
SecurityWeek 2026-09-30
The Hacker News 2026-09-30