Advisories » MGASA-2026-0481

Updated openssl package fixes security vulnerabilities

Publication date: 09 Oct 2026
Modification date: 09 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-84782 , CVE-2026-35189 , CVE-2026-35191 , CVE-2026-42772 , CVE-2026-54872 , CVE-2026-54873 , CVE-2026-54875 , CVE-2026-72897 , CVE-2026-75804 , CVE-2026-75805 , CVE-2026-75806 , CVE-2026-77696 , CVE-2026-84784

Description

DTLS Retransmits Handshake Messages From a Stale Buffer Offset.
(CVE-2026-84782)
Excessive Memory Allocation in Relative CRLDP Processing.
(CVE-2026-35189)
QUIC Unvalidated Amplification Credit may be Over Accounted.
(CVE-2026-35191)
Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC.
(CVE-2026-42772)
Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves.
(CVE-2026-54872)
QUIC STREAM Fragment Metadata DoS. (CVE-2026-54873)
Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V.
(CVE-2026-54875)
Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake.
(CVE-2026-72897)
QUIC Connection-Level Flow Control is Not Enforced for Streams.
(CVE-2026-75804)
NULL Pointer Dereference in CMP Client Revocation Response Handling.
(CVE-2026-75805)
Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS.
(CVE-2026-75806)
Timing Side-Channel in SM2 Signature Generation. (CVE-2026-77696)
QUIC: Unbounded RETIRE_CONNECTION_ID Backlog. (CVE-2026-84784)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36358
• https://www.openwall.com/lists/oss-security/2026/09/22/7
• https://www.openwall.com/lists/oss-security/2026/09/29/28
• https://lists.debian.org/debian-security-announce/2026/msg00444.html
• https://ubuntu.com/security/notices/USN-8847-1
• https://ubuntu.com/security/notices/USN-8861-1
• https://www.cve.org/CVERecord?id=CVE-2026-84782
• https://www.cve.org/CVERecord?id=CVE-2026-35189
• https://www.cve.org/CVERecord?id=CVE-2026-35191
• https://www.cve.org/CVERecord?id=CVE-2026-42772
• https://www.cve.org/CVERecord?id=CVE-2026-54872
• https://www.cve.org/CVERecord?id=CVE-2026-54873
• https://www.cve.org/CVERecord?id=CVE-2026-54875
• https://www.cve.org/CVERecord?id=CVE-2026-72897
• https://www.cve.org/CVERecord?id=CVE-2026-75804
• https://www.cve.org/CVERecord?id=CVE-2026-75805
• https://www.cve.org/CVERecord?id=CVE-2026-75806
• https://www.cve.org/CVERecord?id=CVE-2026-77696
• https://www.cve.org/CVERecord?id=CVE-2026-84784

SRPMS

10/core

• openssl-3.5.9-1.mga10