Release date:
2026-09-18 08:50:40 UTC
Description:
* SECURITY UPDATE: excessive memory use buffering DTLS records
- debian/patches/openssl-1.1.1-cve-2026-54874.patch: copy only the record's
own on-wire bytes into the queue entry in dtls1_buffer_record(), and copy
them back into the live read buffer in dtls1_copy_record(), instead of
handing the whole ~16.7KB read buffer to the queue and allocating a fresh
one, so a peer sending a stream of tiny next-epoch records can no longer
pin ~1.7MB of heap per connection; also lower the cap on the next-epoch
(unprocessed_rcds) queue from 100 records to 16, which the same patch
passes to dtls1_buffer_record() as an argument so that the other two
queues keep the 100-record limit.
- CVE-2026-54874
Updated packages:
-
alt-openssl11_1.1.1w-3.10_amd64.deb
sha:f3fafe270e90e38d8392475bda5f829e704b3e35
-
alt-openssl11-dev_1.1.1w-3.10_amd64.deb
sha:b487d39e7e20130b3741241d6cd1703db705a8d7
-
alt-openssl11-doc_1.1.1w-3.10_all.deb
sha:47b770479a0edbad7abbd3caf3e735108ed8465e
-
alt-openssl11-libs_1.1.1w-3.10_amd64.deb
sha:94ccf87c90a101a65957b26a18c4673f5aa4f70f
-
alt-openssl11_1.1.1w-3.10_arm64.deb
sha:103f000475214f2c64f0db38c280078dd7d24ce0
-
alt-openssl11-dev_1.1.1w-3.10_arm64.deb
sha:a8e9fbfde88b8a267023e1d3be31ed0c51f7be80
-
alt-openssl11-libs_1.1.1w-3.10_arm64.deb
sha:34c254f8ec455c53fd73a4b2412f256af145bd54
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
