OpenSSL’s DTLS fix matters if you ship calls, WebRTC, or UDP TLS

OpenSSL released fixes on September 29 for a high-severity DTLS flaw that can leak heap memory as unencrypted handshake data or crash the process. Only software that uses OpenSSL for DTLS (UDP TLS) is in scope, such as WebRTC data channels, VoIP keying and other UDP-secured paths.

Public fixes cover the 4.0, 3.6, 3.5, and 3.4 branches. OpenSSL 3.0’s public support ended September 7, so the 3.0.23 fix is premium-only unless your distro backported it. Ubuntu and Debian already shipped packages for several releases.

If your product speaks DTLS through OpenSSL, patch the handshake resend bug.

The 5-Minute Cyber Brief

Know what matters before your first meeting.

Weekday mornings. Five minutes. What changed in security, why it matters.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

CVE-2026-84782: a resend timer that reuses the wrong buffer position

CVE-2026-84782 sits in DTLS handshake retransmission. DTLS fragments large handshake messages across UDP datagrams. If sending pauses mid-message and the resend timer fires, vulnerable OpenSSL used the paused buffer position instead of restarting the resent message. The peer could receive wrongly labeled handshake bytes that included leftover heap memory, or the process could crash on an overrun.

OpenSSL rates the issue High and advises installing High fixes as soon as possible. CISA scored it CVSS 8.2 with exploitation “none” at publication. Laurent Gaffie of Secorizon reported the bug; Ryan Hooper developed the fix. OpenSSL also shipped thirteen other fixes the same day; the next most serious (CVE-2026-84783, Moderate) affects only OpenSSL 4.0 multi-threaded certificate-chain builds.

DTLS users are exposed, and OpenSSL 3.0 has no public fix

Most TLS-over-TCP stacks are not exposed. Anything that terminates or initiates DTLS with a linked OpenSSL is, including WebRTC SFUs, some VPN concentrators, IoT stacks and custom UDP protocols. A memory leak plus a reliable crash path is reason enough to move the rebuild up the list, even without a public exploit.

OpenSSL 3.0 is the harder case. Teams still building or shipping 3.0 binaries have no public upstream fix. They must move to 3.5 LTS or 4.0, pay for a support contract, or rely on distro backports (Ubuntu 22.04/24.04 packages were updated September 29).

Find DTLS users, upgrade, and plan the 3.0 exit

• Find DTLS consumers. Inventory services and products that link OpenSSL and speak DTLS / WebRTC / SRTP keying. Plain TLS 1.3 TCP listeners can stay off this list.
• Upgrade public branches. Move to OpenSSL 4.0.3, 3.6.5, 3.5.9, or 3.4.8 (or newer). Prefer 3.5 LTS for long-lived products.
• Apply distro packages. Ubuntu 26.04 / 24.04 / 22.04 and Debian 13 already published openssl package updates for this CVE. Reboot after install so every process reloads the library.
• Plan the 3.0 exit. If you still vendor OpenSSL 3.0 inside an appliance or container, schedule a branch upgrade; 3.0.23 is not a public download.
• No workaround. OpenSSL lists none. Patch or remove the DTLS listener.

Details

• CVE: CVE-2026-84782 (DTLS handshake resend / heap disclosure or crash)
• Severity: OpenSSL High; CISA CVSS 8.2
• Fixed public: 4.0.3, 3.6.5, 3.5.9, 3.4.8
• Premium-only: 3.0.23, 1.1.1zj, 1.0.2zs
• Reporter: Laurent Gaffie (Secorizon); fix by Ryan Hooper
• Disclosure: September 29, 2026
• Also same day: CVE-2026-84783 (Moderate, OpenSSL 4.0) and 12 Low issues including QUIC and timing side-channels

Hunt / verify

• openssl version on build hosts and runtime images; map to the fixed table above.
• Search SBOMs / package locks for libssl / OpenSSL 3.0.x and 3.4.x below the fixed builds.
• Confirm WebRTC / DTLS-facing containers were restarted after the library update.

OpenSSL CVE-2026-84782 (DTLS heap leak/crash) — upgrade to 4.0.3/3.6.5/3.5.9/3.4.8 or distro package; inventory DTLS/WebRTC users; plan exit from OpenSSL 3.0.

Sources

• OpenSSL Security Advisories (Sep 29, 2026)
• The Hacker News: OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory Unencrypted (Sep 30, 2026)
• Ubuntu security notices for openssl / libssl (Sep 29, 2026 packages)

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].