CVE-2026-84782 is a vulnerability in OpenSSL's DTLS retransmission mechanism where handshake message writes suspended before completion are improperly handled. A remote attacker can exploit this during handshake retransmission to cause OpenSSL to read beyond the message buffer or overwrite internal state, resulting in out-of-bounds memory reads or process crashes. This can lead to information disclosure of sensitive memory contents or denial of service. The vulnerability affects software using DTLS over UDP with non-blocking I/O configurations. Standard TLS over TCP is unaffected. Red Hat's Hardened Images RPMs have been updated with chunkah-0.7.0-1.1.hum1 to fix this issue. The vulnerability is rated as Important by Red Hat with a CVSS 3.1 base score of 7.4 (Red Hat) and 8.2 (NVD).

An unauthenticated remote attacker can trigger out-of-bounds memory reads or cause the OpenSSL process to crash during DTLS handshake retransmission. This may lead to disclosure of sensitive information such as cryptographic keys or memory addresses, potentially aiding further attacks. Additionally, the vulnerability can cause denial of service by crashing the affected process. The impact is limited to DTLS over UDP with non-blocking I/O; typical TLS over TCP connections are not affected.

Red Hat has released an update for Red Hat Hardened Images RPMs including chunkah-0.7.0-1.1.hum1 that addresses this vulnerability. Users should apply this update as per Red Hat's guidance available at https://images.redhat.com/. No additional mitigations are specified. Patch status is confirmed by the vendor advisory.