Security: OpenSSL 3.5.7 vulnerable to DTLS heap memory leak / DoS (CVE-2026-84782)

NethSecurity
1

Hi,

NethSecurity 8.8.0 currently includes libopenssl3 version 3.5.7-r1. This version is affected by CVE-2026-84782, a critical heap memory leak (out-of-bounds read) and denial-of-service vulnerability triggered during DTLS handshake retransmission sequences:

root@nethsec:~# apk list | grep libopenssl3
libopenssl3-3.5.7-r1 x86_64 {feeds/base/libs/openssl} (Apache-2.0) [installed]

Any service utilizing OpenSSL for datagram/UDP transport (such as DTLS-enabled VPN tunnels or session handlers) exposed on the WAN can be targeted by an attacker to leak process memory or crash the daemon.

Upstream OpenSSL has addressed this issue in versions 3.5.9+ (and 3.6.5+ / 3.0.23+). Could an updated libopenssl3 package be scheduled for NethSecurity 8.8.0?

Thanks!

2

Hello,
CVE-2026-84782 is real, and OpenSSL 3.5.9, which fixes it, will be in a new NethSecurity release planned before December, based on the next OpenWrt 25.12 service release.

As far as I understand, the practical risk is low. OpenSSL rates it High, not Critical, and it only affects DTLS. No NethSecurity service uses DTLS: OpenVPN runs TLS over its own UDP transport, and IPsec, nginx and SNMP don’t use DTLS.