Double free in OpenSSL - CVE-2026-18798

Vulnerability identifier: #VU145416

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-18798

CWE-ID: CWE-415

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to double free in OpenSSL QUIC stack default packet handler when processing a malformed initial packet. A remote attacker can send a specially crafted initial packet to cause a denial of service.

The issue is triggered when channel creation fails after a QRX object is passed into connection creation, such as with a non-compliant INITIAL packet carrying a destination connection ID shorter than 8 bytes.

OpenSSL
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
FreeBSD
Basesystem Module
Ubuntu
openEuler
openssl (Ubuntu package)
libopenssl-3-fips-provider-32bit-debuginfo
libopenssl3-32bit-debuginfo
libopenssl3
openssl-3-debuginfo
openssl-3
libopenssl-3-fips-provider-debuginfo
openssl-3-debugsource
libopenssl3-debuginfo
libopenssl-3-devel
libopenssl-3-fips-provider
libopenssl-3-fips-provider-32bit
libopenssl3-32bit
openssl
openssl-debuginfo
openssl-debugsource
openssl-devel
openssl-libs
openssl-perl
openssl-help
openssl (Debian package)

Install security update from vendor's website.

OpenSSL - addressed in versions 3.5.8, 3.6.4, 4.0.2
openssl (Ubuntu package) - addressed in versions 3.0.2-0ubuntu1.29, 3.0.13-0ubuntu3.15, 3.5.5-1ubuntu3.4, 3.5.5-1ubuntu3.5
libopenssl-3-fips-provider-32bit-debuginfo - update to 3.5.0-150700.5.50.1
libopenssl3-32bit-debuginfo - update to 3.5.0-150700.5.50.1
libopenssl3 - update to 3.5.0-150700.5.50.1
openssl-3-debuginfo - update to 3.5.0-150700.5.50.1
openssl-3 - update to 3.5.0-150700.5.50.1
libopenssl-3-fips-provider-debuginfo - update to 3.5.0-150700.5.50.1
openssl-3-debugsource - update to 3.5.0-150700.5.50.1
libopenssl3-debuginfo - update to 3.5.0-150700.5.50.1
libopenssl-3-devel - update to 3.5.0-150700.5.50.1
libopenssl-3-fips-provider - update to 3.5.0-150700.5.50.1
libopenssl-3-fips-provider-32bit - update to 3.5.0-150700.5.50.1
libopenssl3-32bit - update to 3.5.0-150700.5.50.1
openssl - update to 3.5.6-7
openssl-debuginfo - update to 3.5.6-7
openssl-debugsource - update to 3.5.6-7
openssl-devel - update to 3.5.6-7
openssl-libs - update to 3.5.6-7
openssl-perl - update to 3.5.6-7
openssl-help - update to 3.5.6-7
openssl (Debian package) - update to 3.5.7-1~deb13u2

• https://openssl-library.org/news/secadv/20260825.txt

• Multiple vulnerabilities in OpenSSL
• Debian update for openssl
• FreeBSD update for OpenSSL
• Ubuntu update for openssl
• Ubuntu update for openssl
• SUSE update for openssl-3
• openEuler 24.03 LTS SP4 update for openssl