OpenSSL released patches for 14 vulnerabilities, including CVE-2026-84782, a high-severity flaw in the DTLS handshake that can leak heap memory fragments or cause application crashes remotely without authentication, scoring 8.2 CVSS. Another medium-severity flaw (CVE-2026-84783) allows remote denial-of-service on multi-threaded TLS clients. WolfSSL version 5.9.4 addresses 11 vulnerabilities, including three high-severity issues that enable attackers to bypass peer authentication by exploiting certificate validation weaknesses or Raw Public Key support misconfigurations. These vulnerabilities affect WolfSSL integrations with software like Nginx, HAProxy, and Apache httpd. Additional medium and low severity issues involve certificate validation bypass, handshake sequencing errors, use-after-free, and skipped revocation checks. Most require specific configurations or legacy API usage.

The OpenSSL DTLS vulnerability (CVE-2026-84782) can lead to sensitive heap memory disclosure or application crashes causing denial-of-service, exploitable remotely without authentication. The medium-severity OpenSSL flaw can cause denial-of-service in multi-threaded TLS clients. WolfSSL's high-severity vulnerabilities allow attackers to bypass peer authentication, potentially enabling man-in-the-middle attacks or unauthorized access in affected configurations. Medium and low severity issues may allow certificate validation bypass, denial-of-service, or server impersonation under certain conditions. No active exploitation has been reported.

Users should upgrade OpenSSL to the latest patched versions that address CVE-2026-84782, CVE-2026-84783, and other vulnerabilities. Similarly, WolfSSL users should update to version 5.9.4 or later to mitigate the authentication bypass and other security issues. Vendors managing integrations with affected libraries should verify their configurations and apply patches promptly. No additional mitigations are indicated beyond applying these official fixes.