OpenSSL DTLS: buffering future-epoch records retains a full 16 KB read buffer each, ~1200x memory amplification

Impact

While a DTLS handshake is in progress, records arriving for the next epoch are buffered so they can be processed once the local endpoint catches up. Each buffered record retains the entire read buffer it arrived in - sized for the largest possible DTLS record, around 16 KB - rather than just its own bytes, and up to 100 records are buffered per connection. A peer sending a stream of small forged next-epoch records pins roughly 1.7 MB per association while sending a fraction of that, an amplification factor of about 1200, multiplied across as many associations as it can open. OpenSSL rates this Low: per-connection retention stays bounded, and any concurrent-association limit the application already enforces also bounds total exposure. The record carries a 7.5 CVSS score. Worth knowing about for DTLS-based telemetry or VPN termination on management networks; it is a memory-exhaustion risk, not a memory-safety one.

Who can reach it

Any peer that can send UDP to a DTLS server and start a handshake. Unauthenticated - the records only need to claim the next epoch, they do not need to be valid.

What to do

OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are affected. Per the advisory: 4.0 users upgrade to 4.0.2, 3.6 to 3.6.4, 3.5 to 3.5.8, 3.4 to 3.4.7, 3.0 to 3.0.22; 1.1.1 to 1.1.1zi and 1.0.2 to 1.0.2zr are premium-support-only. Restart every DTLS-serving process after the upgrade. Given the Low severity, folding this into your normal patch cycle alongside the other 2026-08-25 OpenSSL fixes is reasonable; capping concurrent DTLS associations bounds exposure in the meantime.

References

Related entries

• libssh: incorrect AES-GCM finalization removes integrity protection on SSH sessionsCVE-2026-59847 · libssh (AES-GCM finalization check, OpenSSL backend)High
• Xen (vRTC): Out-of-bounds read in vRTC emulation - hypervisor memory disclosure to a guestCVE-2026-62430 · Xen (vRTC)High
• OpenSSL: crafted CMS message causes an 8-byte out-of-bounds heap write during CMS_decrypt()CVE-2026-63072 · OpenSSL CMS decryption (AES-WRAP-PAD key unwrap output buffer)High
• OpenSSL QUIC: a peer withholding acknowledgements makes ACK-only metadata accumulate for the connection's lifeCVE-2026-63075 · OpenSSL QUIC packet history (ACK-only packet metadata retention)High
• OpenSSL CMP: unchecked protectionAlg parameter type is dereferenced as a PBMParameter and crashes the processCVE-2026-63076 · OpenSSL CMP password-based MAC verification (protectionAlg parameter type check)High
• Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot): Slot 0 of the client's ISM device array isCVE-2026-64048 · Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot)High