CVE-2026-84782— DTLS Retransmits Handshake Messages From a Stale Buffer Offset
一分钟漏洞结论
影响对象
OpenSSL OpenSSL
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspende
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-84782 基础信息
漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
DTLS Retransmits Handshake Messages From a Stale Buffer Offset
来源: CVE Program / CVE List V5
Vulnerability Description
Issue summary: The DTLS retransmission logic does not correctly handle
a handshake message write that is suspended part-way through.
The retransmitted message can be read past the message buffer and
the retransmission overwrites the internal state the suspended write
needs to resume correctly.
Impact summary: The retransmitted message can disclose a heap memory
to the peer as plaintext handshake data or cause a crash and a Denial
of Service when the read reaches an unmapped memory region.
CWE: CWE-125: Out-of-bounds Read
Description: DTLS handshake messages can be written out in multiple
fragments, and a write can suspend mid-message (returning WANT_WRITE)
if the underlying transport temporarily cannot accept more data. While
such a write is suspended, the DTLS retransmission timer may
independently fire and ask the retransmission logic to resend an
earlier, already-acknowledged-as-sent message from its retransmit
queue.
The retransmission logic reused the same internal buffer and position
tracking as the message that was still being written, without
resetting the position back to the start of the message being
retransmitted. As a result the retransmission was read starting from
wherever the suspended write had left off, producing a mislabelled
message whose body was leftover bytes from the other, larger message
still in flight - content that was never meant to be sent at that
point, and which could run past the end of the allocated buffer.
Separately, even when the retransmission is positioned correctly,
allowing it to run to completion while another write is suspended
overwrites the same shared bookkeeping that the suspended write
depends on to resume. When the application later resumes the
suspended write (via a subsequent SSL_read(), SSL_write(),
SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a
state inconsistent with the message and aborts the process in
a debugging build.
The fix resets the retransmission's read position to the start of the
message before resending, and skips retransmission entirely whenever a
handshake write is still suspended, deferring to the next call that
resumes it instead.
FIPS impact: no
The affected code is outside the FIPS module boundary.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-84782 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-84782 的情报信息
请登录查看更多情报信息。
CVE-2026-84782 其他参考 (5)
-
https://openssl-library.org/news/secadv/20260929.txt vendor-advisory
同批安全公告 · OpenSSL · 2026-09-29 · 共 14 条
| CVE-2026-35189 | Excessive Memory Allocation in Relative CRLDP Processing | |
| CVE-2026-35191 | QUIC Unvalidated Amplification Credit may be Over Accounted | |
| CVE-2026-75806 | Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS | |
| CVE-2026-75804 | QUIC Connection-Level Flow Control is Not Enforced for Streams | |
| CVE-2026-75805 | NULL Pointer Dereference in CMP Client Revocation Response Handling | |
| CVE-2026-42772 | Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC | |
| CVE-2026-54873 | QUIC STREAM Fragment Metadata DoS | |
| CVE-2026-54872 | Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves | |
| CVE-2026-54875 | Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V | |
| CVE-2026-77696 | Timing Side-Channel in SM2 Signature Generation | |
| CVE-2026-72897 | Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake | |
| CVE-2026-84784 | QUIC: Unbounded RETIRE_CONNECTION_ID Backlog | |
| CVE-2026-84783 | Use-After-Free in X.509 Extension Cache Under Concurrent Use |
IV. Related Vulnerabilities
Same product: OpenSSL
-
CVE-2026-84784
QUIC: Unbounded RETIRE_CONNECTION_ID Backlog -
CVE-2026-84783
Use-After-Free in X.509 Extension Cache Under Concurrent Use -
CVE-2026-77696
Timing Side-Channel in SM2 Signature Generation -
CVE-2026-75806
Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes D -
CVE-2026-75805
NULL Pointer Dereference in CMP Client Revocation Response H
Same vendor: OpenSSL
-
CVE-2026-84784
QUIC: Unbounded RETIRE_CONNECTION_ID Backlog -
CVE-2026-84783
Use-After-Free in X.509 Extension Cache Under Concurrent Use -
CVE-2026-77696
Timing Side-Channel in SM2 Signature Generation -
CVE-2026-75806
Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes D -
CVE-2026-75805
NULL Pointer Dereference in CMP Client Revocation Response H
Same weakness: CWE-125
-
CVE-2026-102567
CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deseri -
CVE-2026-102521
lib0 `readFromDataView` out-of-bounds read -
CVE-2026-102360
lib0 `readUint8Array` performs an unbounded read past the en -
CVE-2026-102507
Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in -
CVE-2026-95509
Qt for MCUs 字符串格式化越界读取漏洞
V. Comments for CVE-2026-84782
暂无评论