Out-of-bounds read in OpenSSL DTLS retransmission
FreeBSD-SA-26:68.openssl · CVE-2026-84782
Our decision for FreeSense
FreeBSD corrected this on 2026-09-29, after the FreeBSD source pin of FreeSense 1.0 (pinned 2026-08-03). The fix arrives with the next FreeBSD pin of each line that is still updated. No one has checked yet whether FreeSense is exposed in practice.
- Advisory: corrected 2026-09-29
- FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
- FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
- FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
By FreeSense version
| Version | Status | FreeBSD pin |
|---|---|---|
| FreeSense 1.01.0.7 · frozen, no further fixes | Open | 2026-08-03e004ff15 |
| FreeSense 1.11.1.9 | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
| FreeSense 1.21.2.0-DEVELOPMENT | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
Workaround
No workaround is available, but applications that do not use DTLS are not affected.
What FreeBSD says
A DTLS handshake message write can be suspended part-way through when the underlying transport temporarily cannot accept more data. If the retransmission timer fired while such a write was suspended, the resent message reused the buffer and offset of the suspended write without resetting the offset. The resent message was read from that stale offset and could run past the end of the allocated buffer. The retransmission also overwrote state the suspended write needed in order to resume.
Impact
The retransmitted message may include heap memory contents, disclosing them to the DTLS peer as plaintext handshake data. If the read reaches unmapped memory, the application crashes, resulting in a Denial of Service (DoS).
Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.