DSA-6465-1 openssl - security update
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit, which may result in denial of service. Additional details can be found in the upstream advisories: https://openssl-library.org/news/secadv/20260813.txt https://openssl-library.org/news/secadv/20260825.txt https://security-tracker.debian.org/tracker/DSA-6465-1
CSIRTS triage
- What
- OpenSSL contains multiple vulnerabilities resulting in denial of service conditions.
- Who is affected
- All OpenSSL deployments using affected versions across all systems.
- Urgency
- High; multiple DoS vulnerabilities can disrupt TLS/SSL services, though exploitation details are limited in the advisory.
- Action
- Update OpenSSL to the patched version referenced in DSA-6465-1 for Debian systems and check upstream advisories for other distributions.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch OpenSSL
Get an email when a new OpenSSL advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00376.html
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-144560.73% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 52% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-144570.98% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 60% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-187981.5% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 72% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-548740.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-630720.61% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 47% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-630730.93% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 59% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-630740.49% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-630750.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-630761.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 69% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-758030.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-14456 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-14457 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-18798 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-54874 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63072 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63073 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63074 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63075 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-63076 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-75803 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[UPDATE] [mittel] OpenSSL: Schwachstelle ermöglicht Denial of Servicecert-bund
- medium[UPDATE] [mittel] OpenSSL: Mehrere Schwachstellencert-bund
- unknownUSN-8678-3: OpenSSL vulnerabilityubuntu
- high[NEW] [high] FreeBSD Project FreeBSD OS: Multiple vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in OpenSSL (August 26, 2026)cert-fr-avis
- unknownUSN-8678-2: OpenSSL, OpenSSL 1.0 vulnerabilitiesubuntu
- unknownUSN-8678-1: OpenSSL vulnerabilitiesubuntu
- unknownCVE-2026-75803: Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report su…nvd
- highCVE-2026-63076: Issue summary: OpenSSL CMP password based protection verification only checks whether the prot…nvd
- highCVE-2026-63075: Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-elici…nvd
- mediumCVE-2026-63074: Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificate…nvd
- criticalCVE-2026-63073: Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguis…nvd
More from Debian Security Advisories
- highDSA-6496-1 nginx - security update2026-09-12
- unknownDSA-6497-1 xorg-server - security update2026-09-12
- unknownDSA-6495-1 spip - security update2026-09-11
- unknownDSA-6494-1 kamailio - security update2026-09-11
- unknownDSA-6493-1 libevent - security update2026-09-11