USN-8678-2: OpenSSL, OpenSSL 1.0 vulnerabilities

unknownCVE-2024-2511 CVE-2024-5535 CVE-2026-54874 CVE-2026-63072

USN-8678-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding fix for OpenSSL and OpenSSL 1.0 on Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. In addition, this update also fixes the following issues that were not previously addressed in those releases: It was discovered that OpenSSL incorrectly handled TLS handshake message buffering. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. (LP: #2161371) It was discovered that OpenSSL incorrectly handled session cache management when processing TLSv1.3 sessions. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. This issue only affected OpenSSL 1.1.1 on Ubuntu 18.04 LTS. (CVE-2024-2511) It was discovered that OpenSSL incorrectly handled the SSL_select_next_proto function when called with an empty client protocol list. A remote attacker could possibly use this issue to cause OpenSSL to disclose private memory contents to the peer, leading to a loss of confidentiality. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-5535) Original advisory details: It was discovered that OpenSSL incorrectly handled buffering of DTLS records for a future epoch. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. (CVE-2026-54874) It was discovered that OpenSSL incorrectly handled CMS key unwrapping. A remote attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial of service or arbitrary code execution. (CVE-2026-63072)

CSIRTS triage

vendor: OpenSSL product: OpenSSL Denial of serviceaffected: 1.0 and 1.1.1 on Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS

What: OpenSSL incorrectly handles TLS handshake message buffering and TLSv1.3 session cache management, leading to excessive memory consumption.
Who is affected: OpenSSL and OpenSSL 1.0 on Ubuntu 14.04 LTS, 16.04 LTS, and 18.04 LTS.
Urgency: Moderate; denial of service via memory exhaustion in legacy and current OpenSSL versions.
Action: Install Ubuntu security updates USN-8678-2 and related patches.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch OpenSSL

Get an email when a new OpenSSL advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-25
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8678-2

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation likely imminentCVE-2024-2511EPSS puts this in the most-targeted tier (54.0% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 99% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2024-55355.6% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 92% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-548740.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-630720.61% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 47% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2024-2511	coverage & exploitation status	NVD · CVE.org
CVE-2024-5535	coverage & exploitation status	NVD · CVE.org
CVE-2026-54874	coverage & exploitation status	NVD · CVE.org
CVE-2026-63072	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] FreeBSD Project FreeBSD OS: Multiple vulnerabilitiescert-bund
medium[NEW] [medium] OpenSSL: Multiple vulnerabilitiescert-bund
unknownMultiple vulnerabilities in OpenSSL (August 26, 2026)cert-fr-avis
unknownUSN-8678-1: OpenSSL vulnerabilitiesubuntu
highCVE-2026-63072: Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the…nvd
highCVE-2026-54874: Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress cau…nvd
unknownDSA-6465-1 openssl - security updatedebian
medium[UPDATE] [medium] OpenSSL: Vulnerability enables denial of service and information disclosurecert-bund
highexploited[UPDATE] [high] Oracle Communications: Multiple vulnerabilitiescert-bund
highexploited[UPDATE] [high] Oracle Communications: Multiple vulnerabilitiescert-bund
high[UPDATE] [high] Splunk Splunk Enterprise: Multiple vulnerabilitiescert-bund