BSD PortsOpenSSL -- Multiple vulnerabilities
· CVE-2026-84782, CVE-2026-84783, CVE-2026-35189, CVE-2026-35191, CVE-2026-42772, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84784 · VuXML entry
The OpenSSL project reports: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782) [High] Use-After-Free in X.509 Extension Cache Under Concurrent Use (CVE-2026-84783) [Moderate] Excessive Memory Allocation in Relative CRLDP Processing (CVE-2026-35189) [Low] QUIC Unvalidated Amplification Credit may be Over Accounted (CVE-2026-35191) [Low] Potential CPU DoS via O(n^2) Fragment Reassembly in …
Affected versions
- openssl < 3.5.9,1
- openssl30 < 3.0.23
- openssl34 < 3.4.8
- openssl36 < 3.6.5
- openssl40 < 4.0.3
- FreeBSD >= 15.1 < 15.1_4; >= 15.0 < 15.0_14; >= 14.5 < 14.5_1; >= 14.4 < 14.4_10
By system
3 still vulnerable, 3 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/openssl | 3.0.16,1 | vulnerable since 2026-09-30 | |
| NetBSD | security/openssl | 3.6.5 | not listed | |
| MidnightBSD | security/openssl | 3.5.9 | out of range, by version | |
| FreeBSD | security/openssl | 3.5.9,1 | fixed | |
| FreeBSD | security/openssl30 | 3.0.22 | vulnerable since 2026-09-30 | |
| GhostBSD | security/openssl34 | 3.4.7 | vulnerable since 2026-09-30 | |
| FreeBSD | security/openssl36 | 3.6.5 | fixed | |
| MidnightBSD | security/openssl36 | 3.6.5 | out of range, by version | |
| FreeBSD | security/openssl40 | 4.0.3 | fixed |