Release date:
2026-09-18 08:30:25 UTC
Description:
* SECURITY UPDATE: excessive memory use buffering DTLS records
- debian/patches/openssl-1.1.1-cve-2026-54874.patch: copy only the record's
own on-wire bytes into the queue entry in dtls1_buffer_record(), and copy
them back into the live read buffer in dtls1_copy_record(), instead of
handing the whole ~16.7KB read buffer to the queue and allocating a fresh
one, so a peer sending a stream of tiny next-epoch records can no longer
pin ~1.7MB of heap per connection; also lower the cap on the next-epoch
(unprocessed_rcds) queue from 100 records to 16, which the same patch
passes to dtls1_buffer_record() as an argument so that the other two
queues keep the 100-record limit.
- CVE-2026-54874
Updated packages:
-
alt-openssl11_1.1.1w-3.10_amd64.deb
sha:1527dd41f72c7ba927f856ec5b191625fd5b187b
-
alt-openssl11-dev_1.1.1w-3.10_amd64.deb
sha:1c399b708da2be2182d6a28351f57566c1cfb866
-
alt-openssl11-doc_1.1.1w-3.10_all.deb
sha:d396d1fee8bc5c09adf5356e328f846963482bbc
-
alt-openssl11-libs_1.1.1w-3.10_amd64.deb
sha:a3827d7ef0ffd24ca01c93ead0e35bdeddaa0568
-
alt-openssl11_1.1.1w-3.10_arm64.deb
sha:67045c650bdc9e1876d430aee1d0f06cc21649de
-
alt-openssl11-dev_1.1.1w-3.10_arm64.deb
sha:d02fb7f9f7f5873f9edae8d4ee0a462fb7cea19a
-
alt-openssl11-libs_1.1.1w-3.10_arm64.deb
sha:2d68f2d971005ae6475beeead4c59cc78168d7d6
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
