{
  "schema_version": "1.7.0",
  "id": "MGASA-2026-0481",
  "published": "2026-10-09T17:00:24Z",
  "modified": "2026-10-09T16:44:58Z",
  "summary": "Updated openssl package fixes security vulnerabilities",
  "details": "DTLS Retransmits Handshake Messages From a Stale Buffer Offset.\n(CVE-2026-84782)\nExcessive Memory Allocation in Relative CRLDP Processing.\n(CVE-2026-35189)\nQUIC Unvalidated Amplification Credit may be Over Accounted.\n(CVE-2026-35191)\nPotential CPU DoS via O(n^2) Fragment Reassembly in QUIC.\n(CVE-2026-42772)\nTiming Side-Channel in Scalar Multiplication for Non-NIST EC Curves.\n(CVE-2026-54872)\nQUIC STREAM Fragment Metadata DoS. (CVE-2026-54873)\nNon-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V.\n(CVE-2026-54875)\nOut-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake.\n(CVE-2026-72897)\nQUIC Connection-Level Flow Control is Not Enforced for Streams.\n(CVE-2026-75804)\nNULL Pointer Dereference in CMP Client Revocation Response Handling.\n(CVE-2026-75805)\nUnauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS.\n(CVE-2026-75806)\nTiming Side-Channel in SM2 Signature Generation. (CVE-2026-77696)\nQUIC: Unbounded RETIRE_CONNECTION_ID Backlog. (CVE-2026-84784)\n",
  "upstream": [
    "CVE-2026-84782",
    "CVE-2026-35189",
    "CVE-2026-35191",
    "CVE-2026-42772",
    "CVE-2026-54872",
    "CVE-2026-54873",
    "CVE-2026-54875",
    "CVE-2026-72897",
    "CVE-2026-75804",
    "CVE-2026-75805",
    "CVE-2026-75806",
    "CVE-2026-77696",
    "CVE-2026-84784"
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.mageia.org/MGASA-2026-0481.html"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=36358"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/09/22/7"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/09/29/28"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-security-announce/2026/msg00444.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8847-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8861-1"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Mageia:10",
        "name": "openssl",
        "purl": "pkg:rpm/mageia/openssl?arch=source&distro=mageia-10"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.5.9-1.mga10"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    }
  ],
  "credits": [
    {
      "name": "Mageia",
      "type": "COORDINATOR",
      "contact": [
        "https://wiki.mageia.org/en/Packages_Security_Team"
      ]
    }
  ]
}