{"id":"CLSA-2026-1788856499","summary":"Fix CVE(s): CVE-2026-54874, CVE-2026-63072","details":"   * SECURITY UPDATE: Unbounded memory retention in the DTLS record layer.\n     dtls1_buffer_record() adopted the entire live read buffer for every queued\n     record and allocated a fresh one, so a peer could pin roughly 16.7 KB of\n     heap per queued record regardless of how small the record actually was,\n     up to the 100-entry queue limit, exhausting memory on the endpoint.\n     - debian/patches/CVE-2026-54874.patch: copy only the received record into\n       a right-sized allocation and restore it on retrieval, leaving the live\n       read buffer in place, in ssl/record/rec_layer_d1.c, ssl/record/record.h\n       and ssl/record/ssl3_record.c.\n     - CVE-2026-54874\n   * SECURITY UPDATE: Heap buffer overflow in CMS key-agreement recipient\n     processing. For AES key wrap with padding the output size query returns\n     inlen-8 and drives the allocation, while the key-unwrap failure paths\n     then cleanse the full inlen, writing eight bytes past the allocation.\n     - debian/patches/CVE-2026-63072.patch: allocate at least the input length\n       in cms_kek_cipher() in crypto/cms/cms_kari.c.\n     - debian/patches/CVE-2026-63072-test.patch: add the upstream regression\n       test to test/cmsapitest.c and test/recipes/80-test_cmsapi.t.\n     - CVE-2026-63072","modified":"2026-10-26T09:32:03.922819167Z","published":"2026-09-08T08:35:09Z","upstream":["CVE-2026-54874","CVE-2026-63072"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1788856499.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072"}],"affected":[{"package":{"name":"libssl-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libssl-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788856499.json"}},{"package":{"name":"libssl-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libssl-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788856499.json"}},{"package":{"name":"libssl1.1","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libssl1.1?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788856499.json"}},{"package":{"name":"openssl","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/openssl?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788856499.json"}}],"schema_version":"1.9.0"}