OpenSSL contained multiple vulnerabilities including a heap buffer over-read in ASN.1 parsing (CVE-2026-34180), acceptance of forged CMS AuthEnvelopedData messages (CVE-2026-34182), NULL pointer dereferences causing crashes (e.g., CVE-2026-42764, CVE-2026-42766, CVE-2026-42767), unbounded memory growth in QUIC handling (CVE-2026-34183), and cryptographic bypasses such as ignoring IV in AES-OCB mode (CVE-2026-42770) and incorrect tag processing in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446). Some vulnerabilities could lead to denial of service or information disclosure, and others could allow bypassing integrity or authentication checks. These issues were fixed in updated OpenSSL packages provided by Ubuntu for multiple LTS releases and other distributions. The vendor advisory confirms the availability of patches and recommends updating to the specified package versions.

The vulnerabilities could allow attackers to cause OpenSSL to crash (denial of service), obtain sensitive information through buffer over-reads or cryptographic bypasses, bypass message authentication and integrity checks, and potentially execute arbitrary code in some cases. The impact varies by vulnerability but includes denial of service, information disclosure, and weakening of cryptographic guarantees.

Fixes for these vulnerabilities are available in updated OpenSSL packages for affected Ubuntu releases and other Linux distributions. Users should apply the relevant system updates and reboot their systems to ensure all changes take effect. Ubuntu Pro provides extended security coverage for some older releases. No additional mitigation beyond applying the official patches is indicated by the vendor advisories.