# CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS CVE-2026-75806 is fixed in 19 products on 1 platform, first by libssl3t64 3.5.5-1ubuntu3.6, released September 28, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-75806 - Priority: Routine - CVSS: 5.3 (Moderate) - EPSS: 0.0110 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Sep 28, 2026 - Weakness: Improper Validation of Specified Quantity in Input - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-75806 ## Description Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. This is a Denial of Service limited to the targeted association. There is no memory safety or confidentiality impact. CWE: CWE-1284: Improper Validation of Specified Quantity in Input Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and an authentication tag. When decrypting such a record the record layer passed the record length to the cipher implementation before checking that the record was long enough to contain the explicit IV and the tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and the record layer treated this as an internal failure and raised a fatal internal_error alert instead of treating the record as one that failed authentication. In TLS 1.2 the same record causes a fatal internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS. The fix validates the record length against the explicit IV and tag length before any AEAD processing, so that TLS reports bad_record_mac and DTLS silently discards the record. FIPS impact: no The affected code is outside the FIPS module boundary. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | edk2-aarch64 amzn 2023 | 20260508-2.amzn2023 | [ALAS2023-2026-3227](https://patchblox.com/security/data/fix/linux/alas2023-2026-3227.md) | Nov 7, 2026 | | Linux | edk2-ovmf amzn 2023 | 20260508-2.amzn2023 | [ALAS2023-2026-3227](https://patchblox.com/security/data/fix/linux/alas2023-2026-3227.md) | Nov 7, 2026 | | Linux | edk2-shell-aa64 amzn 2023 | 20260508-2.amzn2023 | [ALAS2023-2026-3227](https://patchblox.com/security/data/fix/linux/alas2023-2026-3227.md) | Nov 7, 2026 | | Linux | edk2-shell-x64 amzn 2023 | 20260508-2.amzn2023 | [ALAS2023-2026-3227](https://patchblox.com/security/data/fix/linux/alas2023-2026-3227.md) | Nov 7, 2026 | | Linux | libssl3 Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.30 | [libssl3 3.0.2-0ubuntu1.30](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libssl3-3.0.2-0ubuntu1.30.md) | Sep 30, 2026 | | Linux | libssl3t64 Ubuntu 24.04.5 LTS (noble) | 3.0.13-0ubuntu3.16 | [libssl3t64 3.0.13-0ubuntu3.16](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libssl3t64-3.0.13-0ubuntu3.16.md) | Sep 30, 2026 | | Linux | libssl3t64 Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.6 | [libssl3t64 3.5.5-1ubuntu3.6](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libssl3t64-3.5.5-1ubuntu3.6.md) | Sep 28, 2026 | | Linux | openssl Debian 12.15 (bookworm) | 3.0.22-1~deb12u2 | [DEBIAN-CVE-2026-75806](https://patchblox.com/security/data/fix/linux/debian-cve-2026-75806.md) | Sep 30, 2026 | | Linux | openssl Debian 13.5 (trixie) | 3.5.7-1~deb13u3 | [DEBIAN-CVE-2026-75806](https://patchblox.com/security/data/fix/linux/debian-cve-2026-75806.md) | Sep 30, 2026 | | Linux | openssl Debian 14 | 3.6.5-1 | [DEBIAN-CVE-2026-75806](https://patchblox.com/security/data/fix/linux/debian-cve-2026-75806.md) | Sep 30, 2026 | | Linux | openssl Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.30 | [openssl 3.0.2-0ubuntu1.30](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-openssl-3.0.2-0ubuntu1.30.md) | Sep 30, 2026 | | Linux | openssl Ubuntu 24.04.5 LTS (noble) | 3.0.13-0ubuntu3.16 | [openssl 3.0.13-0ubuntu3.16](https://patchblox.com/security/data/fix/linux/ubuntu-noble-openssl-3.0.13-0ubuntu3.16.md) | Sep 30, 2026 | | Linux | openssl Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.6 | [openssl 3.5.5-1ubuntu3.6](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-3.5.5-1ubuntu3.6.md) | Sep 28, 2026 | | Linux | openssl amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-3 opensuse-leap 16.0 | 3.5.0-160000.11.1 | [OPENSUSE-SU-2026:22102-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22102-1.md) | Nov 7, 2026 | | Linux | openssl-3 sles 15.6 | 3.1.4-150600.5.67.1 | [SUSE-SU-2026:4419-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4419-1.md) | Oct 2, 2026 | | Linux | openssl-3 sles 15.7 | 3.5.0-150700.5.53.2 | [SUSE-SU-2026:4414-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4414-1.md) | Oct 2, 2026 | | Linux | openssl-3 sles 16.0 | 3.5.0-160000.11.1 | [SUSE-SU-2026:24245-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24245-1.md) | Nov 7, 2026 | | Linux | openssl-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-debugsource amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-devel amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-fips-provider-latest amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-fips-provider-latest-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-perl amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-provider-legacy Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.6 | [openssl-provider-legacy 3.5.5-1ubuntu3.6](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-provider-legacy-3.5.5-1ubuntu3.6.md) | Sep 28, 2026 | | Linux | openssl-snapsafe-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-snapsafe-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.