SB2026092171 - Anolis OS update for openssl1.1

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092171

SB2026092171 - Anolis OS update for openssl1.1

Published: September 21, 2026 Updated: September 30, 2026

Security Bulletin ID SB2026092171
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Asymmetric Resource Consumption (Amplification) (CVE-ID: CVE-2026-54874)

CWE-ID: CWE-405 - Asymmetric Resource Consumption (Amplification)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to asymmetric resource consumption in DTLS record buffering when receiving future-epoch records during a handshake in progress. A remote attacker can send numerous small forged DTLS records claiming to belong to the next epoch to cause a denial of service.

Up to 100 such records may be buffered per connection, retaining around 1.7 megabytes of memory because the implementation keeps the entire read buffer for each buffered record.


Remediation

Install update from vendor's website.

References