FreeBSD-SA-26:68.openssl Security Advisory

{
  "id": "d016e930cdf0158113a5e97bd7d5d076ba4329c99fbc72a53d7078b1f8f8551a",
  "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-26:68.openssl.asc",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "FreeBSD-SA-26:68.openssl Security Advisory",
    "summary": "A DTLS retransmission can read beyond an allocated buffer, potentially disclosing heap memory to a peer or crashing the application. No workaround is available; applications that do not use DTLS are not affected.",
    "evidence": "A DTLS handshake message write can be suspended part-way through when the underlying transport temporarily cannot accept more data. If the retransmission timer fired while such a write was suspended, the resent message reused the buffer and offset of the suspended write without resetting the offset. The resent message was read from that stale offset and could run past the end of the allocated buffer.",
    "products": [
      {
        "name": {
          "value": "FreeBSD",
          "evidence": "All supported versions of FreeBSD."
        },
        "prerequisites": [
          {
            "value": "applications that do not use DTLS are not affected",
            "evidence": "No workaround is available, but applications that do not use DTLS are not affected."
          }
        ],
        "fixed_versions": [
          {
            "value": "15.1-STABLE",
            "evidence": "Corrected: 2026-09-29 15:56:25 UTC (stable/15, 15.1-STABLE)"
          },
          {
            "value": "15.1-RELEASE-p4",
            "evidence": "2026-09-29 16:00:12 UTC (releng/15.1, 15.1-RELEASE-p4)"
          },
          {
            "value": "15.0-RELEASE-p14",
            "evidence": "2026-09-29 15:59:21 UTC (releng/15.0, 15.0-RELEASE-p14)"
          },
          {
            "value": "14.5-STABLE",
            "evidence": "2026-09-29 15:56:42 UTC (stable/14, 14.5-STABLE)"
          },
          {
            "value": "14.5-RELEASE-p1",
            "evidence": "2026-09-29 16:09:12 UTC (releng/14.5, 14.5-RELEASE-p1)"
          },
          {
            "value": "14.4-RELEASE-p10",
            "evidence": "2026-09-29 15:57:36 UTC (releng/14.4, 14.4-RELEASE-p10)"
          }
        ],
        "affected_versions": [
          {
            "value": "All supported versions of FreeBSD",
            "evidence": "Affects: All supported versions of FreeBSD."
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-84782",
        "evidence": "CVE Name: CVE-2026-84782"
      },
      {
        "value": "CVE-2026-84783",
        "evidence": "The Moderate issue, CVE-2026-84783, affects only OpenSSL 4.0 and does not affect FreeBSD."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-freebsd-security",
  "document_id": 23623,
  "published_at": "2026-09-29T00:00:00+00:00"
}