SB2026082636 - FreeBSD update for OpenSSL
Published: August 26, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) NULL pointer dereference (CVE-ID: CVE-2026-14457)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to null pointer dereference in RFC7250 raw public key signature algorithm selection when handling the "signature_algorithms_cert" TLS extension. A remote attacker can send a crafted TLS handshake message to cause a denial of service.
The issue requires raw public keys to be enabled and only a private key, without an associated certificate, to be configured locally.
2) Double free (CVE-ID: CVE-2026-18798)
CWE-ID: CWE-415 - Double Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to double free in OpenSSL QUIC stack default packet handler when processing a malformed initial packet. A remote attacker can send a specially crafted initial packet to cause a denial of service.
The issue is triggered when channel creation fails after a QRX object is passed into connection creation, such as with a non-compliant INITIAL packet carrying a destination connection ID shorter than 8 bytes.
3) Asymmetric Resource Consumption (Amplification) (CVE-ID: CVE-2026-54874)
CWE-ID: CWE-405 - Asymmetric Resource Consumption (Amplification)
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to asymmetric resource consumption in DTLS record buffering when receiving future-epoch records during a handshake in progress. A remote attacker can send numerous small forged DTLS records claiming to belong to the next epoch to cause a denial of service.
Up to 100 such records may be buffered per connection, retaining around 1.7 megabytes of memory because the implementation keeps the entire read buffer for each buffered record.
4) Out-of-bounds write (CVE-ID: CVE-2026-63072)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in OpenSSL CMS decryption key unwrapping logic when decrypting a crafted CMS message through CMS_decrypt(). A remote attacker can supply a crafted CMS message to cause a denial of service.
The issue causes a deterministic 8-byte heap write immediately past the allocation when the key-wrap OID is changed to select the padded variant.
5) Format string error (CVE-ID: CVE-2026-63073)
CWE-ID: CWE-134 - Use of Externally-Controlled Format String
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use of externally-controlled format string in OpenSSL CMP response validation when processing an unexpected sender distinguished name. A remote attacker can send a crafted CMP response to cause a denial of service.
This path is reached when the client configures an expected sender or uses a pinned server certificate whose subject becomes the default expected sender.
6) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-63074)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in OpenSSL CMP extraCerts caching when processing rejected CMP messages containing additional certificates. A remote user can repeatedly send CMP requests with unique extra certificates to cause a denial of service.
The issue affects servers that reuse a single OSSL_CMP_CTX for the lifetime of the server process, allowing the untrusted certificate stack to grow without being expunged after message rejection.
7) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-63075)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the OpenSSL QUIC stack when retaining ACK-only packet metadata during connection processing. A remote user can establish a QUIC connection, send numerous PING frames, and withhold acknowledgements to cause a denial of service.
Exploitation requires the peer to complete a QUIC handshake, and the memory growth is scoped to the lifetime of the connection.
8) NULL pointer dereference (CVE-ID: CVE-2026-63076)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper type validation leading to invalid pointer dereference in OpenSSL CMP password-based protection verification when processing a crafted protectionAlg parameter in a CMP message. A remote attacker can send a specially crafted CMP message to cause a denial of service.
CMP is a specialized feature that must be explicitly enabled, and on the client side exploitation is possible when communicating with a malicious or on-path CMP server.
Remediation
Install update from vendor's website.