Network services stack vulnerabilities · Page 2

QUIC STREAM Fragment Metadata DoS

Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains allocated is entirely under the control of the potentially malicious remote peer. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: To save copy operation from the packet buffer to the stream reassemble buffer the QUIC stack leaves the stream data on the packet buffer waiting to be copied to a bu

• Update to 3.4.8
• Update to 3.5.5-1ubuntu3.7
• Update to 3.5.7-1~deb13u3
• Update to 3.5.9
• Update to 3.6.5
• Update to 3.6.5-1
• Update to 4.0.3

Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves

Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated constant-time implementation pads the secr

• Update to 1.0.1f-1ubuntu2.27+esm17
• Update to 1.0.2g-1ubuntu4.20+esm19
• Update to 1.0.2n-1ubuntu5.13+esm7
• Update to 1.0.2zs
• Update to 1.1.1-1ubuntu2.1~18.04.23+esm11
• Update to 1.1.1zj
• Update to 3.0.23
• Update to 3.4.8
• Update to 3.5.7-1~deb13u3
• Update to 3.5.9
• Update to 3.6.5
• Update to 3.6.5-1
• Update to 4.0.3

Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407: Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While

• Update to 3.4.8
• Update to 3.5.5-1ubuntu3.7
• Update to 3.5.7-1~deb13u3
• Update to 3.5.9
• Update to 3.6.5
• Update to 3.6.5-1
• Update to 4.0.3

QUIC Unvalidated Amplification Credit may be Over Accounted

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC 9000, Section 8), to confirm

• Update to 3.5.5-1ubuntu3.6
• Update to 3.5.7-1~deb13u3
• Update to 3.5.9
• Update to 3.6.5
• Update to 3.6.5-1
• Update to 4.0.3

Excessive Memory Allocation in Relative CRLDP Processing

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of resident memory on the receivin

• Update to 1.0.1f-1ubuntu2.27+esm17
• Update to 1.0.2g-1ubuntu4.20+esm19
• Update to 1.0.2n-1ubuntu5.13+esm7
• Update to 1.0.2zs
• Update to 1.1.1-1ubuntu2.1~18.04.23+esm11
• Update to 1.1.1zj
• Update to 3.0.23
• Update to 3.4.8
• Update to 3.5.7-1~deb13u3
• Update to 3.5.9
• Update to 3.6.5
• Update to 3.6.5-1
• Update to 4.0.3

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy used by UDP, TCP, and DNS-over-TLS. An unauthenticated client can send an RFC 2136 UPDATE that the proxy or forward plugin passes unchanged to an update-capable upstream. If that upstream trusts CoreDNS's source address or connection and does not require an attacker-unknown end-to-end TSIG, the request appears to originate from CoreDNS and can add,

CoreDNS: Unauthenticated memory exhaustion in custom transports

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.Msg.Unpack on attacker-controlled DNS section counts before dns.DefaultMsgAcceptFunc validates the fixed header. An unauthenticated client can use DNS name compression and excessive section counts to amplify allocation before the plugin chain, so plugin-level rate limiting cannot prevent concurrent requests from exhausting memory and terminating CoreDNS. The ordinary UDP and TCP listeners are not affected b

AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphe

• Update to 2024.02-2ubuntu0.10
• Update to 3.0.13-0ubuntu3.15
• Update to 3.0.13-0ubuntu3.15+Fips1
• Update to 3.0.2-0ubuntu1.29
• Update to 3.0.2-0ubuntu1.29+Fips1
• Update to 3.0.22
• Update to 3.0.22-1~deb12u1
• Update to 3.4.7
• Update to 3.5.7-1~deb13u2
• Update to 3.5.8
• Update to 3.6.4
• Update to 3.6.4-1
• Update to 4.0.2

Invalid Pointer Dereference in CMP Server via Crafted protectionAlg

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP

• Update to 2024.02-2ubuntu0.10
• Update to 3.0.13-0ubuntu3.15
• Update to 3.0.13-0ubuntu3.15+Fips1
• Update to 3.0.2-0ubuntu1.29
• Update to 3.0.2-0ubuntu1.29+Fips1
• Update to 3.0.22
• Update to 3.0.22-1~deb12u1
• Update to 3.4.7
• Update to 3.5.7-1~deb13u2
• Update to 3.5.8
• Update to 3.6.4
• Update to 3.6.4-1
• Update to 4.0.2

QUIC ACK-only Packet Retention Can Cause Memory Exhaustion

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUI

• Update to 3.4.7
• Update to 3.5.5-1ubuntu3.4
• Update to 3.5.7-1~deb13u2
• Update to 3.5.8
• Update to 3.6.4
• Update to 3.6.4-1
• Update to 4.0.2

CMP Indefinite Cache Growth of ExtraCerts

Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions.

• Update to 3.0.13-0ubuntu3.15
• Update to 3.0.13-0ubuntu3.15+Fips1
• Update to 3.0.2-0ubuntu1.29
• Update to 3.0.2-0ubuntu1.29+Fips1
• Update to 3.0.22
• Update to 3.0.22-1~deb12u1
• Update to 3.4.7
• Update to 3.5.7-1~deb13u2
• Update to 3.5.8
• Update to 3.6.4
• Update to 3.6.4-1
• Update to 4.0.2

Untrusted Sender DN Used as Format String in CMP Response Validation

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent

• Update to 3.4.7
• Update to 3.5.5-1ubuntu3.4
• Update to 3.5.7-1~deb13u2
• Update to 3.5.8
• Update to 3.6.4
• Update to 3.6.4-1
• Update to 4.0.2

Heap Buffer Overflow in CMS Key Unwrapping

Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap

• Update to 0~20180205.c0d9813c-2ubuntu0.3+esm3
• Update to 0~20191122.bd85bf54-2ubuntu3.6+esm1
• Update to 1.0.1f-1ubuntu2.27+esm16
• Update to 1.0.2g-1ubuntu4.20+esm18
• Update to 1.0.2n-1ubuntu5.13+esm6
• Update to 1.1.1-1ubuntu2.1~18.04.23+esm10
• Update to 1.1.1zi
• Update to 3.0.22
• Update to 3.0.22-1~deb12u1
• Update to 3.4.7
• Update to 3.5.7-1~deb13u2
• Update to 3.5.8
• Update to 3.6.4
• Update to 3.6.4-1
• Update to 4.0.2

Excessive Memory Use Buffering DTLS Records for a Future Epoch

Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the s

• Update to 0~20160408.ffea0a2c-2ubuntu0.2+esm4
• Update to 0~20180205.c0d9813c-2ubuntu0.3+esm3
• Update to 1.0.1f-1ubuntu2.27+esm16
• Update to 1.0.2g-1ubuntu4.20+esm18
• Update to 1.0.2n-1ubuntu5.13+esm6
• Update to 1.0.2zr
• Update to 1.1.1-1ubuntu2.1~18.04.23+esm10
• Update to 1.1.1zi
• Update to 3.0.22
• Update to 3.0.22-1~deb12u1
• Update to 3.4.7
• Update to 3.5.7-1~deb13u2
• Update to 3.5.8
• Update to 3.6.4
• Update to 3.6.4-1
• Update to 4.0.2

QUIC Server May Trigger Double Free When Processing INITIAL Packet

Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX objec

• Update to 3.5.5-1ubuntu3.4
• Update to 3.5.7-1~deb13u2
• Update to 3.5.8
• Update to 3.6.4
• Update to 3.6.4-1
• Update to 4.0.2

RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK con

• Update to 3.4.7
• Update to 3.5.5-1ubuntu3.4
• Update to 3.5.7-1~deb13u2
• Update to 3.5.8
• Update to 3.6.4
• Update to 3.6.4-1
• Update to 4.0.2

Unbounded Memory Growth in QUIC Server Incoming Channel Queue

Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC

• Update to 3.5.5-1ubuntu3.4
• Update to 3.5.7-1~deb13u2
• Update to 3.5.8
• Update to 3.6.4
• Update to 3.6.4-1
• Update to 4.0.2

CVE-2026-73283

In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

• Update to 10.5
• Update to 1:10.5p1-1

CVE-2026-73282

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

• Update to 10.5
• Update to 1:10.5p1-1
• Update to 1:6.6p1-2ubuntu2.13+esm4
• Update to 1:7.2p2-4ubuntu2.10+esm10
• Update to 1:7.6p1-4ubuntu0.7+esm6
• Update to 1:8.2p1-4ubuntu0.13+esm3

CVE-2026-73281

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension.

• Update to 10.5
• Update to 1:10.5p1-1