CVE-2026-84783

/// Technical description

Issue summary: The first concurrent use of the same X.509 certificate by

several threads may cause its cached extension data to be freed while

another thread is still using it.

Impact summary: A remote, unauthenticated peer could crash a multi-threaded

TLS client, or a multi-threaded TLS server that requests client

certificates, if the first certificate chains built to the same trusted CA

certificate are built by several connections at the same time. This is a

use-after-free read, which is likely to crash the process, resulting in a

Denial of Service.

CWE: CWE-416: Use After Free

Description: OpenSSL caches the decoded values of a certificate's X.509v3

extensions inside the X509 object the first time they are needed. In

OpenSSL 4.0 this cache is built in two phases: the extension values are

computed while holding a read lock on the certificate, and the results are

then installed into the certificate under a write lock. Because a read lock

does not exclude other readers, several thre

/// Remediation

Check the references section for vendor advisories and patches from openssl. Update openssl to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References