SB20260816509 - Two vulnerabilities in OpenSSL

Description

This security bulletin contains information about 2 vulnerabilities.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-14456)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the QUIC server incoming channel queue when processing valid QUIC Initial packets for unknown destination connection IDs. A remote attacker can send many QUIC Initial packets faster than the application accepts connections to cause a denial of service.

The issue affects the Listener SSL object in the QUIC server implementation and can make the QUIC listener unavailable if pending connections accumulate.

2) Memory leak (CVE-ID: CVE-2026-54876)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of memory after effective lifetime in OCSP response checking during X.509 certificate chain verification when processing a stapled OCSP response containing no single response entries. A remote attacker can send a malicious TLS server response to cause a denial of service.

Only client applications that explicitly enable OCSP response check verification flags are affected.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://openssl-library.org/news/secadv/20260813.txt
• https://openssl-library.org/news/secadv/20260805.txt
• https://github.com/openssl/openssl/commit/d8c5104