CVE-2026-84782

/// Technical description

Issue summary: The DTLS retransmission logic does not correctly handle

a handshake message write that is suspended part-way through.

The retransmitted message can be read past the message buffer and

the retransmission overwrites the internal state the suspended write

needs to resume correctly.

Impact summary: The retransmitted message can disclose a heap memory

to the peer as plaintext handshake data or cause a crash and a Denial

of Service when the read reaches an unmapped memory region.

CWE: CWE-125: Out-of-bounds Read

Description: DTLS handshake messages can be written out in multiple

fragments, and a write can suspend mid-message (returning WANT_WRITE)

if the underlying transport temporarily cannot accept more data. While

such a write is suspended, the DTLS retransmission timer may

independently fire and ask the retransmission logic to resend an

earlier, already-acknowledged-as-sent message from its retransmit

queue.

The retransmission logic reused the same internal buffer and

/// Remediation

Check the references section for vendor advisories and patches from openssl. Update openssl to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References