What is the CVSS score of CVE-2026-75806?

CVE-2026-75806 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-75806?

Yes, a patch is available for CVE-2026-75806. Update the affected software to the latest version immediately.

OpenSSL CVE-2026-75806

Q: Which versions of OpenSSL are affected by CVE-2026-75806?

Denial of service in OpenSSL's DTLS 1.2 record processing allows remote, unauthenticated attackers to disrupt affected endpoints by sending an undersized AEAD record that the library fails to…. A patch is available.

EUVD-2026-89011 MEDIUM

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-09-29

GHSA-4h8f-fwpc-hwwf

OpenSSL

5.3

CVSS 3.1 · Vendor

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach DTLS 1.2 listener over network
Delivery

Craft undersized AEAD record
Exploit

Send malformed datagram to endpoint
Execution

Trigger length mishandling in record layer
Impact

Denial-of-service on DTLS service

Vulnerability Assessment

Weakness	CWE CWE-1284 ASVS 5.0 V2 - Validation and Business Logic Input size validation
Exploitation Conditions	The target must be an OpenSSL-based endpoint that accepts DTLS 1.2 connections using an AEAD ciphersuite (e.g., OpenVPN/DTLS-based VPNs, WebRTC/SRTP-DTLS media servers, SIP-over-DTLS, or CoAP/IoT DTLS services) running an affected version (OpenSSL 4.0.0<4.0.3, 3.6.0<3.6.5, 3.5.0<3.5.9, 3.4.0<3.4.8, 3.0.0<3.0.23, or 1.1.1<1.1.1zj). The attacker sends an unauthenticated, undersized DTLS 1.2 AEAD record to the datagram listener; no credentials or user interaction are required (PR:N/UI:N). The primary LIMITING factor is reachability: only DTLS deployments are affected - TLS-over-TCP (HTTPS) endpoints are not exposed to this datagram record-processing path - which sharply narrows the vulnerable population despite OpenSSL's ubiquity.
Impact	This is a genuine but low-to-moderate priority availability issue, not a high-severity emergency. The vendor CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) is internally consistent with the description ('unauthenticated and undersized DTLS 1.2 AEAD record causing DoS') and with CWE-1284 (improper validation of a specified quantity/length in input): a malformed record triggers a denial-of-service with only low availability impact and no confidentiality or integrity impact. SSVC reinforces the modest priority - Exploitation: none (no observed exploitation), Automatable: yes (a single crafted datagram can be replayed, so mass automation is plausible), Technical Impact: partial (degradation/crash rather than total compromise). No EPSS score is provided, this CVE is NOT in CISA KEV, and no public exploit code is referenced. The one notable conflict is the input Tags labeling this 'Information Disclosure' - that is inconsistent with the vector (C:N) and the description, which describe a pure DoS; treat the DoS framing as authoritative. Net: a real, patch-worthy bug in a ubiquitous library, but bounded impact (A:L only, DTLS-only reachability) keeps real-world risk low-to-moderate rather than critical.
Exploit ScenarioDerived	An attacker positioned to send datagrams to a DTLS 1.2 endpoint (e.g., a VPN concentrator, WebRTC/SIP media server, or CoAP/IoT service using an AEAD ciphersuite) transmits a specially crafted undersized DTLS 1.2 AEAD record without needing authentication. The OpenSSL record layer mishandles the short record, causing a denial-of-service (crash or connection disruption). No public exploit is identified at time of analysis, but the low complexity (AC:L) and unauthenticated nature make it straightforward to weaponize once the packet format is known.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Denial of service in OpenSSL's DTLS 1.2 record processing allows remote, unauthenticated attackers to disrupt affected endpoints by sending an undersized AEAD record that the library fails to validate properly. Only DTLS-over-datagram deployments are exposed - OpenSSL 4.0.0 through 4.0.2, 3.6.0 through 3.6.4, 3.5.0 through 3.5.8, 3.4.0 through 3.4.7, 3.0.0 through 3.0.22, and 1.1.1 through 1.1.1zi - while TLS-over-TCP services such as HTTPS do not traverse the vulnerable code path. Impact is limited to availability (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L); there is no public exploit identified at time of analysis, SSVC records exploitation as 'none', and the vendor has released fixed versions (notably OpenSSL 4.0.3, along with backports 3.6.5, 3.5.9, 3.4.8, 3.0.23 and 1.1.1zj).

RemediationAI

Upgrade to a fixed OpenSSL build: 4.0.3 on the 4.0 branch, or the corresponding backports 3.6.5, 3.5.9, 3.4.8, 3.0.23 and 1.1.1zj, as published in the vendor release notes at https://github.com/openssl/openssl/releases/tag/openssl-4.0.3 and the advisory at https://openssl-library.org/news/secadv/20260929.txt; because 4.0.3 bundles fifteen fixes including several other availability and side-channel issues (for example CVE-2026-84782 and CVE-2026-84783), patching to that release closes this CVE and its siblings in one step and should be prioritised over cherry-picking this single defect. Where patching must be staged, the highest-value compensating control is to stop exposing the DTLS datagram listener: terminate DTLS behind a TLS-over-TCP front end, disable DTLS cipher suites that use AEAD modes if the deployment can tolerate the loss of modern authenticated encryption, or restrict UDP access to known peer IP ranges at the firewall - the trade-off being that DTLS clients on dynamic addresses will be cut off and AEAD downgrades weaken confidentiality and integrity guarantees. For internet-facing UDP listeners that cannot be filtered, apply datagram rate limiting or a DTLS-aware reverse proxy/load balancer that drops malformed or anomalously short records before they reach OpenSSL, accepting the added latency and the risk that a distributed flood still degrades availability. Hosts used purely for TLS-over-TCP cannot reach the vulnerable code path, so they can be scheduled for routine patching rather than emergency change windows, but they should still be brought to the fixed version to pick up the other 4.0.3 fixes. Confirm the linked OpenSSL version (ldd/version string) in every DTLS-enabled service after upgrade, since static linking and vendored copies frequently leave the vulnerable build in place.

Affected VersionsENISA

OpenSSL 3.5.0 <3.5.9

OpenSSL 3.4.0 <3.4.8

OpenSSL 4.0.0 <4.0.3

OpenSSL 3.0.0 <3.0.23

OpenSSL 3.6.0 <3.6.5

OpenSSL 1.1.1 <1.1.1zj

Affected Packages

euvd openssl fix: 1.1.1zj, 3.0.23, 3.4.8, 3.5.9, 3.6.5, 4.0.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is classified as CWE-1284 (Improper Validation of Specified Quantity in Input) and lives in OpenSSL's DTLS 1.2 record layer handling of AEAD ciphersuites. DTLS runs over unreliable datagrams (UDP), so the record layer parses length and fragment fields from attacker-supplied packets before authentication and integrity checks can succeed; an undersized AEAD record supplies a quantity/length value that the implementation does not bound-check against the expected AEAD tag or ciphertext size, causing a processing failure that terminates or destabilises the connection-handling path. Because the trigger is an unauthenticated datagram arriving at the listener, no handshake completion, credential or user interaction is required (CVSS vector PR:N/UI:N). The vulnerable population is any OpenSSL-linked service that terminates DTLS 1.2 with an AEAD ciphersuite - for example OpenVPN and other DTLS-based VPN concentrators, WebRTC/SRTP-DTLS media servers, SIP-over-DTLS gateways and CoAP/IoT DTLS endpoints. TLS over TCP never enters this code path, which is the single most important scoping fact for triage. EUVD tracks this under EUVD-2026-89011 and lists the affected version ranges as OpenSSL 4.0.0 <4.0.3, 3.6.0 <3.6.5, 3.5.0 <3.5.9, 3.4.0 <3.4.8, 3.0.0 <3.0.23 and 1.1.1 <1.1.1zj. This CVE is one of fifteen security fixes shipped together in the OpenSSL 4.0.3 release, whose most severe item is rated High; the accompanying commit references in the NVD feed (04728a289a823e68137f88da016cb9ede307217d, 050b275cd671a6eed1d6457642d41a5a77aab972, 3a4589d015a9049d47b66f186cf50a8711343a1d, 5af82fefbaf2b5fec2fc0e1d87f112844902f01d) point to related changes in that batch and should not be assumed to map one-to-one onto this specific defect.

Know when OpenSSL gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI 5.3 MEDIUM

Unauthenticated network-reachable DTLS endpoint (AV:N/PR:N/UI:N), low-complexity crafted record (AC:L), and DoS-only impact with no confidentiality or integrity effect (C:N/I:N/A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE MEDIUM

Red Hat 5.3 MEDIUM

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

CVSS changed

Sep 29, 2026 - 17:22 NVD

5.3 (MEDIUM)

CVE Published

Sep 29, 2026 - 13:53 github-releases

MEDIUM 5.3

CVE Published

Sep 29, 2026 - 13:53 github-releases

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of openssl/openssl. NVD scoring and full description are pending.

Threat Intelligence Overview

EPSS Score

0.4%

Top 70% exploitable

Prevalence

Ubiquitous

OpenSSL is the default TLS/DTLS library across most Linux and networked software

Data Quality

8 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

More in OpenSSL

View all

CVE-2014-0160 HIGH Act Now POC

7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

CVE-2021-3711 CRITICAL Act Now POC

9.8 Aug 24

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri

CVE-2014-0195 MEDIUM This Month POC

6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2016-0800 MEDIUM This Month POC

5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se

CVE-2015-0204 MEDIUM This Month POC

4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2022-2068 HIGH Act Now

7.3 Jun 21

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas

CVE-2015-4000 LOW Monitor POC

3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro

CVE-2014-3566 LOW Monitor POC

3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM This Month POC

6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH Act Now

7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

Same weakness CWE-1284 – Improper Validation of Specified Quantity in Input

View all

CVE-2025-9316 MEDIUM POC

6.9

CVE-2026-49777 CRITICAL POC

10.0

CVE-2022-37134 CRITICAL POC

9.8

CVE-2021-43267 CRITICAL POC

9.8

CVE-2025-65548 CRITICAL POC

9.1

CVE-2023-54337 CRITICAL POC

9.1

CVE-2025-5349 HIGH POC

8.8

CVE-2026-82750 HIGH POC

8.3

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
Container bci/bci-sle15-kernel-module-devel:15.7-61.25 Container bci/openjdk-devel:17.0.20.1-21.71 Container bci/openjdk-devel:21.0.12.1-25.71 Container bci/openjdk-devel:25.0.4.1-9.72 Container bci/openjdk:17.0.20.1-20.61 Container bci/openjdk:21.0.12.1-24.60 Container bci/openjdk:25.0.4.1-9.60 Container bci/python:3.13.15-88.58 Container bci/python:3.6.15-84.56 Container suse/sle15:15.7-5.23.43	Affected
Container private-registry/1.2/harbor-core:1.2.1-1.115 Container private-registry/1.2/harbor-exporter:1.2.1-1.115 Container private-registry/1.2/harbor-jobservice:1.2.1-1.113 Container private-registry/1.2/harbor-registry:1.2.1-1.115 Container private-registry/1.2/harbor-registryctl:1.2.1-1.115 Container private-registry/1.2/harbor-trivy-adapter:1.2.1-1.124 Container private-registry/harbor-core:latest Container private-registry/harbor-exporter:latest Container private-registry/harbor-jobservice:latest Container private-registry/harbor-registry:2.8.3-1.85 Container private-registry/harbor-registryctl:latest Container private-registry/harbor-trivy-adapter:0.35.1-1.87 Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.177 Container suse/kiosk/tigervnc-x11vnc:1.14-63.43 Container suse/mariadb:11.8.8-79.42 Image pr_15_7_1_0	Affected
Container private-registry/1.2/harbor-portal:1.2.1-1.124 Container private-registry/harbor-portal:latest Container suse/kea:2.6-80.9 Container suse/kiosk/firefox-esr:153.3-75.45 Container suse/kiosk/pulseaudio:17.0-73.42 Container suse/kiosk/xorg-client:21-81.7 Container suse/kiosk/xorg:21.1-83.42 Container suse/mariadb-client:11.8.8-72.32 Container suse/postgres:16.15-93.41 Container suse/postgres:16.15-contrib-93.41 Container suse/postgres:17.11-83.40 Container suse/postgres:17.11-contrib-83.40 Container suse/postgres:18.6-73.40 Container suse/rmt-server:3.1-72.2 Container suse/samba-client:4.21-75.34 Container suse/samba-server:4.21-76.36 Container suse/samba-toolbox:4.21-76.34 Container third-party/amd/amdgpu-driver:sles-15.7-30.20.1 Container third-party/amd/amdgpu-driver:sles-15.7-30.30.4 Container third-party/amd/amdgpu-driver:sles-15.7-31.10 Container third-party/amd/amdgpu-driver:sles-15.7-31.20 Container third-party/amd/amdgpu-driver:sles-15.7-31.30 Container third-party/amd/amdgpu-driver:sles-15.7-31.40.1 Container third-party/amd/amdgpu-driver:sles-15.7-31.50 Container third-party/nvidia/driver:550-sles15.7 Container third-party/nvidia/driver:570-sles15.7 Container third-party/nvidia/driver:575-sles15.7 Container third-party/nvidia/driver:580-sles15.7 Container third-party/nvidia/driver:590-sles15.7 Container third-party/nvidia/driver:595-sles15.7 Container third-party/nvidia/driver:610-sles15.7 Container third-party/nvidia/driver:615-sles15.7	Affected
Container suse/ltss/sle15.5/sle15:15.5-8.73	Affected
Container suse/ltss/sle15.6/bci-base-fips:15.6-35.106	Affected

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:74162 ADVISORY https://access.redhat.com/errata/RHSA-2026:74166 ADVISORY https://github.com/openssl/openssl/releases/tag/openssl-4.0.3 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-75806 ADVISORY https://seclists.org/oss-sec/2026/q3/1001 ADVISORY https://ubuntu.com/security/notices/USN-8847-1 ADVISORY https://vuldb.com/vuln/411441 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4412/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4413/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4414/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4419/ REF https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d REF https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972 REF https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d REF https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d REF https://openssl-library.org/news/secadv/20260929.txt

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Fixed
SUSE Linux Enterprise Micro 5.3	Fixed
SUSE Linux Enterprise Micro 5.4	Fixed
SUSE Linux Enterprise Server 15 SP4-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud	Not-Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud	Affected
SLES15-SP6-CHOST-BYOS	Not-Affected
SLES15-SP6-CHOST-BYOS	Affected
SLES15-SP6-CHOST-BYOS-Aliyun	Not-Affected
SLES15-SP6-CHOST-BYOS-Aliyun	Affected
SLES15-SP6-CHOST-BYOS-Azure	Not-Affected
SLES15-SP6-CHOST-BYOS-Azure	Affected
SLES15-SP6-CHOST-BYOS-EC2	Not-Affected
SLES15-SP6-CHOST-BYOS-EC2	Affected
SLES15-SP6-CHOST-BYOS-GCE	Not-Affected
SLES15-SP6-CHOST-BYOS-GCE	Affected
SLES15-SP6-CHOST-BYOS-GDC	Not-Affected
SLES15-SP6-CHOST-BYOS-GDC	Affected
SLES15-SP6-CHOST-BYOS-SAP-CCloud	Not-Affected
SLES15-SP6-CHOST-BYOS-SAP-CCloud	Affected
SLES15-SP7-CHOST-BYOS-Aliyun	Not-Affected
SLES15-SP7-CHOST-BYOS-Aliyun	Affected
SLES15-SP7-CHOST-BYOS-Azure	Not-Affected
SLES15-SP7-CHOST-BYOS-Azure	Affected
SLES15-SP7-CHOST-BYOS-EC2	Not-Affected
SLES15-SP7-CHOST-BYOS-EC2	Affected
SLES15-SP7-CHOST-BYOS-GCE	Not-Affected
SLES15-SP7-CHOST-BYOS-GCE	Affected
SLES15-SP7-CHOST-BYOS-GDC	Not-Affected
SLES15-SP7-CHOST-BYOS-GDC	Affected
SLES15-SP7-CHOST-BYOS-SAP-CCloud	Not-Affected