{"id":"DEBIAN-CVE-2026-75806","details":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead.  Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. This is a Denial of Service limited to the targeted association. There is no memory safety or confidentiality impact.  CWE: CWE-1284: Improper Validation of Specified Quantity in Input  Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and an authentication tag. When decrypting such a record the record layer passed the record length to the cipher implementation before checking that the record was long enough to contain the explicit IV and the tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and the record layer treated this as an internal failure and raised a fatal internal_error alert instead of treating the record as one that failed authentication.  In TLS 1.2 the same record causes a fatal internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS.  The fix validates the record length against the explicit IV and tag length before any AEAD processing, so that TLS reports bad_record_mac and DTLS silently discards the record.  FIPS impact: no The affected code is outside the FIPS module boundary.","modified":"2026-09-30T08:00:10.685863768Z","published":"2026-09-29T16:17:11.217Z","upstream":["CVE-2026-75806"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-75806"}],"affected":[{"package":{"name":"openssl","ecosystem":"Debian:12","purl":"pkg:deb/debian/openssl?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.10-1","3.0.10-1~deb12u1","3.0.11-1","3.0.11-1~deb12u1","3.0.11-1~deb12u2","3.0.12-1","3.0.12-2","3.0.13-1~deb12u1","3.0.13-1~deb12u2","3.0.14-1~deb12u1","3.0.14-1~deb12u2","3.0.15-1~deb12u1","3.0.16-1~deb12u1","3.0.17-1~deb12u1","3.0.17-1~deb12u2","3.0.17-1~deb12u3","3.0.18-1~deb12u1","3.0.18-1~deb12u2","3.0.19-1~deb12u1","3.0.19-1~deb12u2","3.0.20-1~deb12u1","3.0.20-1~deb12u2","3.0.22-1~deb12u1","3.0.9-1","3.1.0-1","3.1.1-1","3.1.2-1","3.1.3-1","3.1.4-1","3.1.4-2","3.1.5-1","3.1.5-1.1","3.1.5-1.1+hurd.1","3.2.0-1","3.2.0-2","3.2.1-1","3.2.1-1.1~exp1","3.2.1-2","3.2.1-3","3.2.2-1","3.3.0-1","3.3.0~beta1-1","3.3.1-1","3.3.1-2","3.3.1-5","3.3.1-6","3.3.1-7","3.3.2-1","3.3.2-2","3.4.0-1","3.4.0-2","3.4.0~~beta1-1","3.4.0~~beta1-2","3.4.1-1","3.5.0-1","3.5.0-2","3.5.0-3","3.5.0~~alpha1-1","3.5.0~~beta1-1","3.5.1-1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1","3.5.5-1~deb13u1","3.5.5-1~deb13u2","3.5.6-1~deb13u1","3.5.6-1~deb13u2","3.5.7-1~deb13u1","3.5.7-1~deb13u2","3.5.7-1~deb13u3","3.6.0-1","3.6.0-2","3.6.0~~alpha1-1","3.6.0~~beta1-1","3.6.1-1","3.6.1-2","3.6.1-3","3.6.2-1","3.6.3-1","3.6.4-1","3.6.5-1","4.0.0-1","4.0.0~alpha1-1","4.0.0~beta1-1","4.0.1-1","4.0.2-1","4.0.3-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-75806.json"}},{"package":{"name":"openssl","ecosystem":"Debian:13","purl":"pkg:deb/debian/openssl?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.7-1~deb13u3"}]}],"versions":["3.5.1-1","3.5.1-1+deb13u1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1","3.5.5-1~deb13u1","3.5.5-1~deb13u2","3.5.6-1~deb13u1","3.5.6-1~deb13u2","3.5.7-1~deb13u1","3.5.7-1~deb13u2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-75806.json"}},{"package":{"name":"openssl","ecosystem":"Debian:14","purl":"pkg:deb/debian/openssl?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.1-1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1","3.5.5-1~deb13u1","3.5.5-1~deb13u2","3.5.6-1~deb13u1","3.5.6-1~deb13u2","3.5.7-1~deb13u1","3.5.7-1~deb13u2","3.5.7-1~deb13u3","3.6.0-1","3.6.0-2","3.6.0~~alpha1-1","3.6.0~~beta1-1","3.6.1-1","3.6.1-2","3.6.1-3","3.6.2-1","3.6.3-1","3.6.4-1","3.6.5-1","4.0.0-1","4.0.0~alpha1-1","4.0.0~beta1-1","4.0.1-1","4.0.2-1","4.0.3-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-75806.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}