CVE-2026-54874

A flaw was found in OpenSSL. Receiving a DTLS (Datagram Transport Layer Security) record for a future epoch while a handshake is in progress causes OpenSSL to buffer an excessive amount of memory. This allows a peer to cause memory exhaustion, eventually resulting in a denial of service, using a small amount of network traffic.

To exploit this issue, an attacker needs to send a DTLS record for a future epoch while the handshake is in progress. This can cause excessive consumption of memory, eventually resulting in a denial of service. However, the retained memory is limited to 1.7MB per connection and the limit on simultaneous connections can prevent successful exploitation. For these reasons, this vulnerability has been rated with a low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.