OpenSSL releases patches for multiple security vulnerabilities

OpenSSL has released security updates to address multiple vulnerabilities across its supported branches, including versions 4.0, 3.6, 3.5, 3.4, 3.0, and legacy 1.1.1 and 1.0.2 lines. The updates aim to resolve a range of Moderate and Low-severity issues involving memory mismanagement and integrity checks.

Key vulnerabilities include a Moderate-rated double-free flaw in the QUIC server (CVE-2026-18798) and a heap-corrupting write bug in the CMS decryption code (CVE-2026-63072). The latter allows an attacker to trigger an 8-byte out-of-bounds heap write by manipulating a key-wrap algorithm identifier, potentially leading to a denial of service.

Other addressed flaws include an invalid pointer dereference in the Certificate Management Protocol (CMP) via CVE-2026-63076, memory amplification issues in DTLS record buffering, and various null pointer dereferences. While these flaws can lead to server crashes or heap corruption, the advisory notes there are currently no known paths for remote code execution.