CVE-2026-84783

A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by initiating concurrent connections to a multi-threaded Transport Layer Security (TLS) client or server verifying certificates. Due to improper synchronization when multiple threads simultaneously decode and cache certificate extensions for a shared Certificate Authority (CA) certificate, cached memory can be freed while still in use by another thread. This use-after-free condition results in an invalid memory read, causing the application to crash.

This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires precise race timing during initial concurrent TLS handshakes, resulting in a denial of service without compromising system integrity or confidentiality. The condition is limited to multi-threaded environments where several connections concurrently decode and cache extensions of the same shared Certificate Authority certificate on first use. Because the resulting memory read invalidation causes an application abort rather than remote code execution, the blast radius is confined to process crashes during simultaneous startup traffic bursts.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.