CVE-2026-54874

*** Pendiente de traducción *** Issue summary: Receiving a DTLS record for a future epoch while a handshake<br /> is in progress causes OpenSSL to buffer far more memory than the record<br /> itself requires.<br /> <br /> Impact summary: A peer can use a small amount of network traffic to make an<br /> OpenSSL DTLS endpoint retain a disproportionately large amount of memory,<br /> which may lead to a Denial of Service.<br /> <br /> CWE: CWE-405: Asymmetric Resource Consumption (Amplification)<br /> <br /> Description: While a DTLS handshake is in progress, a peer may legitimately<br /> have already moved on to the next epoch (for example, having sent its<br /> ChangeCipherSpec and Finished messages) before the local endpoint has<br /> processed the same transition, typically because of reordering on the<br /> underlying UDP transport. OpenSSL buffers such early records so that they<br /> can be processed once the local endpoint catches up.<br /> <br /> Buffering a record currently retains the entire read buffer it arrived in,<br /> which is sized to hold the largest possible DTLS record (around 16<br /> kilobytes), rather than just the bytes that make up the record itself. Up<br /> to 100 such records may be buffered per connection. As a result, a peer<br /> that sends a stream of small forged records claiming to belong to the next<br /> epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of<br /> memory, despite sending only a small fraction of that amount of data over<br /> the network.<br /> <br /> An attacker therefore gains a memory amplification factor of around 1200,<br /> and can multiply the effect across as many associations as it is able to<br /> open, making this a remote memory exhaustion Denial of Service risk for<br /> DTLS servers. Since the memory retained per connection remains bounded,<br /> and any limit an application already places on the number of concurrent<br /> associations also bounds the total exposure, this issue has been assessed<br /> as Low severity.<br /> <br /> FIPS impact: no<br /> <br /> No FIPS modules are affected by this issue as the affected code is outside<br /> the OpenSSL FIPS module boundary.<br /> <br /> OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this<br /> issue.<br /> <br /> OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.<br /> OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.<br /> OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.<br /> OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.<br /> OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.<br /> <br /> Premium support customers only:<br /> OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi<br /> OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr<br /> <br /> This issue was reported on 18 May 2026 by Amazon Web Services.<br /> The fix has been developed by Matt Caswell.<br /> <br /> -- cut (non-publishing metadata for internal use) --<br /> Reported by: Amazon Web Services<br /> Fixed by: Matt Caswell