Multiple vulnerabilities in OpenSSL
FreeBSD-SA-26:61.openssl · CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076
Our decision for FreeSense
FreeBSD corrected this on 2026-08-25, after the FreeBSD source pin of FreeSense 1.0 (pinned 2026-08-03). The fix arrives with the next FreeBSD pin of each line that is still updated. No one has checked yet whether FreeSense is exposed in practice.
- Advisory: corrected 2026-08-25
- FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
- FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
- FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
By FreeSense version
| Version | Status | FreeBSD pin |
|---|---|---|
| FreeSense 1.01.0.7 · frozen, no further fixes | Open | 2026-08-03e004ff15 |
| FreeSense 1.11.1.9 | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
| FreeSense 1.21.2.0-DEVELOPMENT | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
Workaround
No workaround is available.
What FreeBSD says
Multiple issues have been reported as part of this advisory with different issues affecting different OpenSSL versions and therefore different FreeBSD versions. Instead of exhaustively listing detailed writeups for each issue, please see the referenced advisory from OpenSSL. Issues affecting FreeBSD 15.x (OpenSSL 3.5): CVE-2026-14457 - Handshake failure with raw public key configurations CVE-2026-18798 - Double free in the QUIC server packet handler CVE-2026-54874 - Excessive memory use buffering DTLS next-epoch records CVE-2026-63072 - Heap buffer overflow in AES-WRAP-PAD unwrap CVE-2026-63073 - Format string injection via CMP sender name CVE-2026-63074 - Unbounded certificate cache growth in the CMP server CVE-2026-63075 - Unbounded QUIC memory growth from ACK-only frames CVE-2026-63076 - NULL dereference via crafted CMP protectionAlg Issues affecting FreeBSD 14.x (OpenSSL 3.0): CVE-20
Impact
The issues include a heap buffer overflow, a double free, a format string injection, a NULL pointer dereference, and several paths that allow a remote peer to force unbounded memory allocation. Security impact ranges from a Denial of Service to a potential remote code execution. See the OpenSSL advisory for specific details.
Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.