CVE-2026-75806: 
OpenSSL vulnerability analysis and mitigation

CVE-2026-75806 is a Denial of Service vulnerability in OpenSSL affecting DTLS 1.2 associations using AEAD cipher suites. An established DTLS 1.2 session can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead — without the attacker possessing any key material. Affected OpenSSL versions include 1.1.1 through 1.1.1zj, 3.0.0 through 3.0.23, 3.4.0 through 3.4.8, 3.5.0 through 3.5.9, 3.6.0 through 3.6.5, and 4.0.0 through 4.0.3. The vulnerability was disclosed on September 29, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-1284 (Improper Validation of Specified Quantity in Input). In the tls1_cipher() function within ssl/record/methods/tls1_meth.c, the receive path invoked EVP_CTRL_AEAD_TLS1_AAD (AEAD processing) before validating that the incoming record was long enough to contain the mandatory explicit IV and authentication tag. When a record is shorter than this combined overhead (eivlen + taglen), the cipher provider rejects the impossible length, and the error path incorrectly raises SSL_AD_INTERNAL_ERROR — a fatal alert that tears down the DTLS association — instead of silently discarding the malformed datagram as the protocol requires. The fix adds a length check (reclen[ctr] < rl->eivlen + rl->taglen) before any AEAD processing, so DTLS silently discards the record and TLS reports bad_record_mac (Red Hat Bugzilla, OpenSSL Commit).

The impact is limited to a Denial of Service against the targeted DTLS 1.2 association. An unauthenticated network attacker who can route a single crafted datagram to an existing DTLS 1.2 session can forcibly terminate that session without knowing any cryptographic key material. There is no memory safety, confidentiality, or integrity impact — the vulnerability cannot be used to decrypt traffic, escalate privileges, or move laterally (Red Hat Bugzilla, Red Hat Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Red Hat Advisory). The vulnerability is network-accessible, requires no privileges or user interaction, and is classified as automatable by NVD SSVC analysis. The EPSS score is approximately 0.387%, reflecting low but non-negligible exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify a target DTLS 1.2 session: Locate a network-accessible service using a vulnerable OpenSSL version (1.1.1 < 1.1.1zj, 3.0.x < 3.0.23, 3.4.x < 3.4.8, 3.5.x < 3.5.9, 3.6.x < 3.6.5, or 4.0.x < 4.0.3) with an active DTLS 1.2 connection using an AEAD cipher suite (e.g., AES-128-GCM).
2. Observe or infer session parameters: Determine the target's UDP address/port and, if possible, the epoch and sequence number of the active DTLS association (e.g., via passive network observation).
3. Craft an undersized DTLS record: Construct a DTLS 1.2 record of type application_data with a payload length shorter than the AEAD overhead (e.g., for AES-128-GCM: less than EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN = 24 bytes). The content does not need to be valid ciphertext.
4. Send the forged datagram: Transmit the crafted UDP datagram to the target server's DTLS port, spoofing the source address of the legitimate peer if necessary.
5. Session termination: The vulnerable OpenSSL record layer passes the undersized record to the AEAD cipher, which rejects the impossible length; the error path raises a fatal internal_error alert, tearing down the DTLS association (Red Hat Bugzilla, OpenSSL Commit).

• Network: Unexpected UDP datagrams directed at DTLS-listening ports with payload lengths shorter than the AEAD overhead (< 24 bytes for AES-GCM); sudden DTLS session terminations from unexpected source addresses.
• Logs: OpenSSL/application logs showing SSL_AD_INTERNAL_ERROR or internal_error fatal alerts on DTLS connections, particularly from IP addresses not matching the legitimate peer; repeated DTLS session resets in a short time window.
• Application Behavior: Unexpected DTLS session drops or reconnection storms in services using DTLS (e.g., VPN gateways, DTLS-based media servers, IoT devices); services reporting SSL_ERROR_SSL errors with internal error codes on the receive path.

OpenSSL has released patched versions addressing this vulnerability: 1.1.1zj, 3.0.23, 3.4.8, 3.5.9, 3.6.5, and 4.0.3. Organizations should upgrade to the appropriate fixed version as soon as possible, prioritizing systems that expose DTLS 1.2 services to untrusted networks. No configuration-based workaround is available; upgrading is the only remediation. Downstream distributions including Red Hat, Ubuntu (USN-8847-1), SUSE, openSUSE, Amazon Linux, and Alpine Linux have also released updated packages (OpenSSL Advisory, Red Hat Advisory, Ubuntu Advisory).

The OpenSSL project published a security advisory on September 29, 2026, and released fixes across all supported branches simultaneously (OpenSSL Advisory). Red Hat and Microsoft both issued advisories, and major Linux distributions (Ubuntu, SUSE, openSUSE, Amazon Linux, Alpine) rapidly released updated packages. The Hacker News covered the disclosure, noting it as part of a broader OpenSSL release addressing multiple security fixes (The Hacker News). Community reaction was measured given the limited scope (DoS only, no confidentiality or integrity impact), though the unauthenticated, network-accessible nature of the attack drew attention from security practitioners.