OpenSSL’s DTLS fix matters if you ship calls, WebRTC, or UDP TLS

OpenSSL released fixes on September 29 for a high-severity DTLS flaw that can leak heap memory as unencrypted handshake data — or crash the process. Only software that uses OpenSSL for DTLS (UDP TLS) is in scope: think WebRTC data channels, VoIP keying, and other UDP-secured paths.

Public fixes cover the 4.0, 3.6, 3.5, and 3.4 branches. OpenSSL 3.0’s public support ended September 7, so the 3.0.23 fix is premium-only unless your distro backported it. Ubuntu and Debian already shipped packages for several releases.

If your product speaks DTLS through OpenSSL, the handshake resend path just became a patch ticket.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

What happened

CVE-2026-84782 sits in DTLS handshake retransmission. DTLS fragments large handshake messages across UDP datagrams. If sending pauses mid-message and the resend timer fires, vulnerable OpenSSL used the paused buffer position instead of restarting the resent message. The peer could receive wrongly labeled handshake bytes that included leftover heap memory, or the process could crash on an overrun.

OpenSSL rates the issue High and advises installing High fixes as soon as possible. CISA scored it CVSS 8.2 with exploitation “none” at publication. Laurent Gaffie of Secorizon reported the bug; Ryan Hooper developed the fix. OpenSSL also shipped thirteen other fixes the same day; the next most serious (CVE-2026-84783, Moderate) affects only OpenSSL 4.0 multi-threaded certificate-chain builds.

Why it matters

Most TLS-over-TCP stacks are not exposed. Anything that terminates or initiates DTLS with a linked OpenSSL — WebRTC SFUs, some VPN concentrators, IoT stacks, and custom UDP protocols — is. Memory disclosure plus a reliable crash path is enough to prioritize the rebuild even without a public exploit.

The OpenSSL 3.0 cliff is the operational sting. Teams still building or shipping 3.0 binaries have no public upstream fix and must move to 3.5 LTS / 4.0, take a paid support contract, or rely on distro backports (Ubuntu 22.04/24.04 packages were updated September 29).

What to do first

• Find DTLS consumers. Inventory services and products that link OpenSSL and speak DTLS / WebRTC / SRTP keying — not every TLS 1.3 TCP listener.
• Upgrade public branches. Move to OpenSSL 4.0.3, 3.6.5, 3.5.9, or 3.4.8 (or newer). Prefer 3.5 LTS for long-lived products.
• Apply distro packages. Ubuntu 26.04 / 24.04 / 22.04 and Debian 13 already published openssl package updates for this CVE — reboot after install so every process reloads the library.
• Plan the 3.0 exit. If you still vendor OpenSSL 3.0 inside an appliance or container, schedule a branch upgrade; 3.0.23 is not a public download.
• No workaround. OpenSSL lists none. Patch or remove the DTLS listener.

Details

• CVE: CVE-2026-84782 (DTLS handshake resend / heap disclosure or crash)
• Severity: OpenSSL High; CISA CVSS 8.2
• Fixed public: 4.0.3, 3.6.5, 3.5.9, 3.4.8
• Premium-only: 3.0.23, 1.1.1zj, 1.0.2zs
• Reporter: Laurent Gaffie (Secorizon); fix by Ryan Hooper
• Disclosure: September 29, 2026
• Also same day: CVE-2026-84783 (Moderate, OpenSSL 4.0) and 12 Low issues including QUIC and timing side-channels

Hunt / verify

• openssl version on build hosts and runtime images; map to the fixed table above.
• Search SBOMs / package locks for libssl / OpenSSL 3.0.x and 3.4.x below the fixed builds.
• Confirm WebRTC / DTLS-facing containers were restarted after the library update.

OpenSSL CVE-2026-84782 (DTLS heap leak/crash) — upgrade to 4.0.3/3.6.5/3.5.9/3.4.8 or distro package; inventory DTLS/WebRTC users; plan exit from OpenSSL 3.0.

Sources

• OpenSSL Security Advisories (Sep 29, 2026)
• The Hacker News: OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory Unencrypted (Sep 30, 2026)
• Ubuntu security notices for openssl / libssl (Sep 29, 2026 packages)

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].