Search: CVE-2026-54874

OpenSSL versions including 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2 improperly handle DTLS records received for a future epoch during an ongoing handshake. This causes OpenSSL to buffer significantly more memory than the record size, allowing a remote attacker to cause a memory exhaustion denial of service by sending a small amount of crafted network traffic. The memory retained per connection is bounded, limiting the overall impact. Fixes are available for all affected versions.