Bug 2537080 (CVE-2026-84782)

Summary: CVE-2026-84782 openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bbrownin, lchilton, rhel-process-autobot, security-response-team, sfeifer, watson-tool-maintainers, zdohnal
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in OpenSSL. The Datagram Transport Layer Security (DTLS) retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to read past the message buffer or overwrite internal state required to resume writing. This issue can result in information disclosure through out-of-bounds memory reads or cause a Denial of Service (DoS) by crashing the process.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2543670, 2543672, 2543674, 2543679, 2543680, 2543681, 2543687, 2543688, 2543689, 2543690, 2543691, 2543692, 2543693, 2543694, 2543695, 2543696, 2543697, 2543698, 2543700, 2543702, 2543704, 2543710, 2543713, 2543714, 2543715, 2543716, 2543717, 2543718, 2543719, 2543720, 2543721, 2543722, 2543666, 2543667, 2543675, 2543677, 2543699, 2543701, 2543703, 2543705, 2543706, 2543707, 2543708, 2543709, 2543711, 2543712, 2543723    
Bug Blocks:    
Deadline: 2026-09-29   

Description OSIDB Bzimport 2026-09-18 20:03:31 UTC 
The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through.
The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly.