Asymmetric Resource Consumption (Amplification) in OpenSSL - CVE-2026-54874
Published: August 26, 2026
Vulnerability identifier: #VU145420
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54874
CWE-ID: CWE-405
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to asymmetric resource consumption in DTLS record buffering when receiving future-epoch records during a handshake in progress. A remote attacker can send numerous small forged DTLS records claiming to belong to the next epoch to cause a denial of service.
Up to 100 such records may be buffered per connection, retaining around 1.7 megabytes of memory because the implementation keeps the entire read buffer for each buffered record.
Affected software
OpenSSL
Debian Linux
FreeBSD
openssl (Debian package)
Debian Linux
FreeBSD
openssl (Debian package)
How to mitigate CVE-2026-54874
Install security update from vendor's website.
OpenSSL - addressed in versions 1.0.2zr, 1.1.1zi, 3.0.22, 3.4.7, 3.5.8, 3.6.4, 4.0.2
openssl (Debian package) - update to 3.5.7-1~deb13u2
openssl (Debian package) - update to 3.5.7-1~deb13u2