Linux · Security advisory · September 14, 2026

ALSA-2026:67165: Security update for 4 packages

ALSA-2026:67165, released September 14, 2026, fixes 10 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
10
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0170
77th percentile

Priority of the 10 CVEs

Patch now 0 Urgent 1 High 9 Routine 0

Fixed package versions

ProductReleaseFixed in
opensslalmalinux 91:3.5.8-1.el9_8
openssl-develalmalinux 91:3.5.8-1.el9_8
openssl-libsalmalinux 91:3.5.8-1.el9_8
openssl-perlalmalinux 91:3.5.8-1.el9_8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2026-75803 openssl: Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying... 9.1 0.0025 None reported
High CVE-2026-18798 openssl: Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial... 7.5 0.0170 None reported
High CVE-2026-63076 Invalid Pointer Dereference in CMP Server via Crafted protectionAlg 7.5 0.0160 None reported
High CVE-2026-14457 RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate 7.5 0.0117 None reported
High CVE-2026-63073 Untrusted Sender DN Used as Format String in CMP Response Validation 9.8 0.0116 None reported
High CVE-2026-63072 Heap Buffer Overflow in CMS Key Unwrapping 7.5 0.0092 None reported
High CVE-2026-14456 Unbounded Memory Growth in QUIC Server Incoming Channel Queue 7.5 0.0073 None reported
High CVE-2026-54874 Excessive Memory Use Buffering DTLS Records for a Future Epoch 7.5 0.0062 None reported
High CVE-2026-63074 CMP Indefinite Cache Growth of ExtraCerts 7.5 0.0059 None reported
High CVE-2026-63075 QUIC ACK-only Packet Retention Can Cause Memory Exhaustion 7.5 0.0057 None reported
Showing 1 to 10 of 10 1