CVE-2026-84783

A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by initiating concurrent connections to a multi-threaded Transport Layer Security (TLS) client or server verifying certificates. Due to improper synchronization when multiple threads simultaneously decode and cache certificate extensions for a shared Certificate Authority (CA) certificate, cached memory can be freed while still in use by another thread. This use-after-free condition results in an invalid memory read, causing the application to crash.

Last checked: 2026-10-08 01:48 UTC

• No exploitation evidence · CISA Coordinator (Assessed 2026-09-29 16:42 UTC)

References

• NVD: CVE-2026-84783
• Upstream Advisory

Fix Status by Distribution

Fix evidence last checked: 2026-09-30 07:23 UTC