USN-8678-3: OpenSSL vulnerability

unknownpublic exploitCVE-2026-75803 CVE-2026-14456 CVE-2026-14457 CVE-2026-18798 CVE-2026-54874 CVE-2026-63072

USN-8673-1 fixed vulnerabilities in OpenSSL. The update inadvertently left out the fix for CVE-2026-75803 in Ubuntu 26.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that OpenSSL incorrectly handled the QUIC server incoming channel queue. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14456) It was discovered that OpenSSL incorrectly handled signature algorithm selection when using Raw Public Keys. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14457) It was discovered that OpenSSL incorrectly handled QUIC INITIAL packet processing. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-18798) It was discovered that OpenSSL incorrectly handled buffering of DTLS records for a future epoch. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. (CVE-2026-54874) It was discovered that OpenSSL incorrectly handled CMS key unwrapping. A remote attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial of service or arbitrary code execution. (CVE-2026-63072) It was discovered that OpenSSL incorrectly validated the sender distinguished name in CMP response messages. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-63073) It was discovered that OpenSSL incorrectly limited the growth of an internal certificate cache used during CMP operations. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to

CSIRTS triage

vendor: OpenSSL product: OpenSSL Denial of serviceaffected: Ubuntu 26.04 LTS

What: OpenSSL incorrectly handles QUIC server incoming channel queue, signature algorithm selection with Raw Public Keys, and QUIC INITIAL packet processing.
Who is affected: Systems running OpenSSL on Ubuntu 26.04 LTS with QUIC enabled or using Raw Public Keys.
Urgency: Moderate urgency; denial of service issues in QUIC handling; Ubuntu 26.04 LTS specific.
Action: Apply the cumulative security update from USN-8678-3 including the missing CVE-2026-75803 fix.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch OpenSSL

Get an email when a new OpenSSL advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-31
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8678-3

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-758030.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-144560.73% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 52% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-144570.98% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 60% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-187981.5% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 72% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-548740.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-630720.61% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 47% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-630730.93% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 59% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-630740.49% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-630750.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-630761.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 69% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-75803	coverage & exploitation status	NVD · CVE.org
CVE-2026-14456	coverage & exploitation status	NVD · CVE.org
CVE-2026-14457	coverage & exploitation status	NVD · CVE.org
CVE-2026-18798	coverage & exploitation status	NVD · CVE.org
CVE-2026-54874	coverage & exploitation status	NVD · CVE.org
CVE-2026-63072	coverage & exploitation status	NVD · CVE.org
CVE-2026-63073	coverage & exploitation status	NVD · CVE.org
CVE-2026-63074	coverage & exploitation status	NVD · CVE.org
CVE-2026-63075	coverage & exploitation status	NVD · CVE.org
CVE-2026-63076	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.