USN-8847-1 Critical OpenSSL Vulnerabilities – Ubuntu 26.04 LTS & Earlier – What You Need to Know

Executive Summary

Ubuntu Security Notice USN-8847-1 addresses 11 critical vulnerabilities in OpenSSL that enable Denial of Service (DoS) attacks and sensitive information disclosure. These flaws affect cryptographic operations across TLS, DTLS, and QUIC protocols. Five vulnerabilities are exclusive to Ubuntu 26.04 LTS, making this release particularly critical for organizations running the latest LTS version. This advisory is essential reading for IT security teams managing Ubuntu systems.

Which Systems Are Affected

OpenSSL Versions Across Ubuntu Releases

The vulnerabilities in USN-8847-1 impact OpenSSL packages across multiple Ubuntu releases. However, the scope and severity vary by version:

• Ubuntu 26.04 LTS: Faces the highest risk with 5 exclusive vulnerabilities affecting QUIC protocol handling and cryptographic operations on ARM64 and RISC-V architectures
• Ubuntu 22.04 LTS and earlier: Affected by 6 common vulnerabilities related to memory exhaustion, NULL pointer dereferences, and timing side-channels
• All supported releases: Vulnerable to CVE-2026-35189, CVE-2026-54872, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, and CVE-2026-84782

Services Using OpenSSL for TLS, DTLS, and QUIC Protocols

Organizations should prioritize systems running:

• Web servers (Apache, Nginx) with TLS termination
• VPN gateways and load balancers
• API endpoints and microservices
• QUIC-enabled services and HTTP/3 implementations
• Certificate validation infrastructure
• Any service performing cryptographic operations

The 11 Vulnerabilities Explained

Memory Exhaustion Flaws

CVE-2026-35189 (CRL Distribution Point Memory Exhaustion)

• OpenSSL incorrectly processes Certificate Revocation List (CRL) distribution point names
• Malformed names trigger excessive memory allocation
• Impact: Remote DoS via certificate parsing

CVE-2026-75804 (QUIC Flow Control Bypass) — Ubuntu 26.04 LTS only

• OpenSSL fails to enforce connection-level flow control for QUIC streams
• Attackers send unlimited stream data, exhausting server memory
• Impact: Complete service unavailability

CVE-2026-84784 (QUIC RETIRECONNECTIONID Frame Handling) — Ubuntu 26.04 LTS only

• Improper handling of QUIC RETIRE_CONNECTION_ID frames causes memory exhaustion
• Each malformed frame allocates memory without proper cleanup
• Impact: Rapid memory depletion and service crash

QUIC Protocol Weaknesses

CVE-2026-35191 (QUIC Amplification Credit Accounting) — Ubuntu 26.04 LTS only

• OpenSSL fails to validate amplification credits in QUIC handshakes
• Attackers bypass rate-limiting mechanisms
• Impact: Amplification-based DoS attacks

Timing Side-Channel Attacks

CVE-2026-54872 (Non-NIST Elliptic Curve Scalar Multiplication)

• Scalar multiplication timing varies based on private key bits
• Attackers measure execution time to infer cryptographic material
• Affects: EdDSA, Curve25519, and other non-NIST curves
• Impact: Private key recovery through statistical analysis

CVE-2026-54875 (SM2 Scalar Multiplication on ARM64/RISC-V) — Ubuntu 26.04 LTS only

• SM2 implementation leaks timing information on ARM64 and RISC-V
• Attackers extract private keys through precise timing measurements
• Impact: Compromise of Chinese cryptographic standard implementations

CVE-2026-77696 (SM2 Signature Generation Timing Leak)

• SM2 signature generation exhibits timing variations
• Attackers correlate timing with signature operations
• Impact: Private key disclosure through side-channel analysis

Handshake and Protocol Handling Issues

CVE-2026-72897 (SSL Context Switching Out-of-Bounds Read) — Ubuntu 26.04 LTS only

• Improper SSL context handling during TLS handshakes
• Attackers trigger context switches that read beyond allocated memory
• Impact: Information disclosure or crash

CVE-2026-75805 (CMP NULL Pointer Dereference)

• OpenSSL fails to validate pointers during Certificate Management Protocol (CMP) processing
• Malformed CMP responses trigger NULL pointer dereference
• Impact: Service crash and DoS

CVE-2026-75806 (DTLS 1.2 AEAD Record Validation)

• OpenSSL processes undersized DTLS records before authentication
• Attackers send malformed records to trigger crashes
• Impact: DoS via protocol violation

CVE-2026-84782 (DTLS Handshake Retransmission)

• Incorrect handling of DTLS handshake message retransmissions
• Attackers manipulate retransmission logic to cause state confusion
• Impact: Handshake failures and service disruption

Real-World Attack Scenarios

Denial of Service via Resource Exhaustion

Scenario: An attacker targets a web server running OpenSSL with QUIC support.

1. Attacker sends specially crafted QUIC RETIRE_CONNECTION_ID frames
2. Each frame bypasses flow control validation (CVE-2026-75804, CVE-2026-84784)
3. Server allocates memory for each frame without proper cleanup
4. Within seconds, server memory reaches capacity
5. Service becomes unresponsive; legitimate users cannot connect
6. Server administrator observes out-of-memory errors in system logs

Timeline: Attack can succeed in under 60 seconds with minimal bandwidth.

Timing Side-Channel Exploitation of Cryptographic Operations

Scenario: An attacker targets an API endpoint using SM2 certificates on ARM64 infrastructure.

1. Attacker initiates thousands of TLS connections requiring SM2 signature verification
2. Using high-precision timing measurements, attacker records signature generation times
3. Statistical analysis of timing variations reveals bits of the private key (CVE-2026-54875, CVE-2026-77696)
4. After sufficient samples, attacker reconstructs the complete private key
5. Attacker can now forge certificates or decrypt past communications

Timeline: Key recovery typically requires 10,000–100,000 signature samples (hours to days of measurement).

Out-of-Bounds Memory Reads During TLS Handshakes

Scenario: An attacker exploits SSL context switching vulnerability.

1. Attacker initiates TLS connection and sends crafted handshake messages
2. Messages force rapid SSL context switches (CVE-2026-72897)
3. Context switch logic reads memory beyond allocated buffer
4. Sensitive data (session keys, user credentials) leaks to attacker
5. Alternatively, out-of-bounds read triggers segmentation fault, crashing the service

Impact: Information disclosure or immediate DoS.

Risk Assessment for Your Environment

Primary Impact: DoS and Information Disclosure

Attack Vector: Network-Based (Remote Exploitation)

All vulnerabilities are exploitable remotely without authentication:

• TLS/DTLS handshakes: No credentials required
• QUIC protocol: Unauthenticated connection initiation
• Certificate parsing: Triggered during normal TLS negotiation

Exploitation Complexity: Low to Moderate

• Low complexity: Memory exhaustion attacks (send malformed packets)
• Moderate complexity: Timing side-channel attacks (require statistical analysis)
• Low complexity: NULL pointer dereferences (trigger via protocol violations)

Ubuntu 26.04 LTS: Elevated Risk

Organizations running Ubuntu 26.04 LTS face elevated risk due to:

• 5 exclusive vulnerabilities not present in earlier releases
• QUIC protocol handling particularly vulnerable (3 exclusive CVEs)
• ARM64 and RISC-V support introduces new attack surface (CVE-2026-54875)
• Newer cryptographic implementations may lack hardening against side-channels

How to Detect Vulnerable Systems

Audit OpenSSL Package Versions Immediately

# Check OpenSSL version
openssl version
# List installed OpenSSL packages
dpkg -l | grep openssl
# Verify package details
apt-cache policy libssl3

Expected output for vulnerable systems:

• OpenSSL 3.x versions prior to patched release
• Ubuntu 26.04 LTS with unpatched OpenSSL packages

Monitor for Unexpected Memory Spikes in OpenSSL-Dependent Services

# Monitor memory usage in real-time
watch -n 1 'ps aux | grep -E "nginx|apache|openssl" | grep -v grep'
# Check for out-of-memory events
dmesg | grep -i "out of memory"
# Monitor system memory pressure
free -h
cat /proc/meminfo | grep MemAvailable

Warning signs:

• Memory usage increasing without corresponding traffic increase
• Out-of-memory killer (OOMkiller) events in system logs
• Service crashes with “Cannot allocate memory” errors

Track TLS Context Switches and DTLS Retransmission Anomalies

# Monitor TLS connections
ss -tan | grep ESTABLISHED | wc -l
# Check for DTLS retransmissions (if applicable)
tcpdump -i any -n 'udp port 443' -c 100
# Monitor OpenSSL error logs
tail -f /var/log/syslog | grep -i openssl

Anomalies to watch for:

• Sudden spike in connection count without traffic increase
• High DTLS retransmission rates (>10% of packets)
• Repeated TLS handshake failures

Review System Logs for Out-of-Memory Events

# Search for OOMkiller events
grep -i "killed process" /var/log/syslog
# Check for memory allocation failures
grep -i "cannot allocate" /var/log/syslog
# Monitor kernel messages
journalctl -u kernel | grep -i memory

Immediate Mitigation Steps

Step 1: Update OpenSSL Packages via apt-get

# Update package lists
sudo apt-get update
# Upgrade OpenSSL packages
sudo apt-get upgrade libssl3 libssl-dev openssl
# Verify update
openssl version

Verification: Confirm that OpenSSL version matches the patched release specified in USN-8847-1.

Step 2: Restart All Dependent Services and Daemons

# Restart web servers
sudo systemctl restart nginx
sudo systemctl restart apache2
# Restart VPN services
sudo systemctl restart openvpn
sudo systemctl restart strongswan
# Restart application services
sudo systemctl restart myapp
# Verify services are running
sudo systemctl status nginx apache2 openvpn strongswan

Critical: Restarting services ensures updated OpenSSL libraries are loaded into memory.

Step 3: Prioritize Ubuntu 26.04 LTS Systems

Deploy patches to Ubuntu 26.04 LTS systems first, as they face elevated risk:

• 5 exclusive vulnerabilities
• QUIC protocol vulnerabilities
• Newer architecture support (ARM64, RISC-V)

Step 4: Verify Updates Are Applied Across Your Infrastructure

# Create inventory script
for host in $(cat /path/to/hosts.txt); do
  ssh $host "openssl version" >> openssl_versions.log
done
# Verify all systems are patched
grep -v "patched_version" openssl_versions.log

Ubuntu 26.04 LTS: Special Considerations

Five Vulnerabilities Affect Only This Version

QUIC Protocol Handling Is Particularly Vulnerable

Ubuntu 26.04 LTS includes enhanced QUIC support, introducing three new attack vectors:

• Amplification attacks (CVE-2026-35191): Bypass rate limiting
• Flow control bypass (CVE-2026-75804): Unlimited stream data
• Frame handling (CVE-2026-84784): Memory exhaustion via malformed frames

Recommendation: Disable QUIC support temporarily if not required, or implement network-level rate limiting.

SM2 Cryptographic Operations on ARM64 and RISC-V at Risk

Organizations using SM2 certificates on ARM64 or RISC-V systems face critical risk:

• CVE-2026-54875: Timing side-channel in scalar multiplication
• CVE-2026-77696: Timing leak in signature generation
• Impact: Private key recovery through statistical analysis

Recommendation: Prioritize patching ARM64 and RISC-V systems running SM2 operations.

Accelerated Patching Timeline Recommended

Deploy patches to Ubuntu 26.04 LTS systems within 24 hours of release, compared to the standard 48-72 hour window for earlier releases.

Implementation Checklist

Use this checklist to ensure comprehensive patching and verification:

Pre-Patch Phase

• [ ] Inventory all systems running affected OpenSSL versions
• [ ] Identify services dependent on OpenSSL (web servers, VPN, APIs)
• [ ] Document current OpenSSL versions and service configurations
• [ ] Notify stakeholders of planned maintenance window
• [ ] Prepare rollback procedures if issues arise

Testing Phase

• [ ] Test patches in non-production environments first
• [ ] Verify TLS/DTLS/QUIC functionality after patching
• [ ] Confirm service startup and connectivity
• [ ] Run security scanning tools to validate patch application
• [ ] Document test results and any issues encountered

Deployment Phase

• [ ] Schedule coordinated updates to minimize service disruption
• [ ] Prioritize Ubuntu 26.04 LTS systems (deploy first)
• [ ] Deploy patches during low-traffic periods
• [ ] Restart dependent services after patching
• [ ] Verify services are running and accepting connections

Post-Patch Phase

• [ ] Document patch deployment and verification
• [ ] Monitor post-patch system behavior for 48 hours
• [ ] Check system logs for errors or warnings
• [ ] Verify memory usage remains normal
• [ ] Confirm no increase in failed TLS handshakes
• [ ] Update asset inventory with patched versions

Validation Steps

• [ ] Run openssl version to confirm patch level
• [ ] Test TLS connections: openssl s_client -connect example.com:443
• [ ] Monitor service logs for errors
• [ ] Verify no increase in CPU or memory usage
• [ ] Confirm legitimate users can access services

Frequently Asked Questions

What are the main security risks in USN-8847-1?

The advisory addresses two primary risks:

1. Denial of Service (DoS): Attackers exploit memory exhaustion, NULL pointer dereferences, and flow control failures to crash services or render them unresponsive. These attacks require minimal bandwidth and can succeed in seconds.

2. Sensitive Information Disclosure: Timing side-channel attacks and out-of-bounds memory reads allow attackers to extract private keys, session data, and other sensitive information from running processes.

Which vulnerabilities are specific to Ubuntu 26.04 LTS?

Five vulnerabilities exclusively affect Ubuntu 26.04 LTS:

• CVE-2026-35191: QUIC amplification credit accounting bypass
• CVE-2026-54875: SM2 scalar multiplication timing leak on ARM64/RISC-V
• CVE-2026-72897: SSL context switching out-of-bounds read
• CVE-2026-75804: QUIC connection-level flow control bypass
• CVE-2026-84784: QUIC RETIRECONNECTIONID frame handling

These vulnerabilities represent new attack vectors introduced in Ubuntu 26.04 LTS’s enhanced QUIC and cryptographic implementations.

How quickly should we patch?

Immediate action required:

• Ubuntu 26.04 LTS systems: Patch within 24 hours (elevated risk)
• Ubuntu 22.04 LTS and earlier: Patch within 48-72 hours
• Test in non-production first: Verify functionality before production deployment
• Coordinate updates: Schedule during maintenance windows to minimize disruption

Organizations with QUIC-enabled services or SM2 cryptography should prioritize even more aggressively.

What services are most at risk?

Services most vulnerable to exploitation:

• Web servers (Apache, Nginx) with TLS termination
• VPN gateways and remote access services
• Load balancers handling QUIC or DTLS traffic
• API endpoints performing certificate validation
• Microservices using OpenSSL for encryption
• IoT devices running OpenSSL for secure communication
• 5G infrastructure using QUIC protocol
• Services on ARM64/RISC-V using SM2 cryptography

Can we detect exploitation attempts?

Yes. Monitor for these indicators:

Memory-based attacks:

• Unexpected memory consumption spikes
• Out-of-memory errors in system logs
• Service crashes with “Cannot allocate memory”

Timing side-channel attacks:

• Unusual TLS context switches
• High volumes of failed handshakes
• Repeated connection attempts from same source

Protocol-based attacks:

• High DTLS retransmission rates (>10% of packets)
• Malformed QUIC frames in network logs
• CMP protocol errors in application logs

Do we need to restart services after patching?

Yes, absolutely. Restarting services is critical because:

1. Library loading: OpenSSL is a shared library; running processes continue using old versions until restarted
2. Memory mapping: Restarting ensures updated binaries are loaded into active memory
3. Vulnerability closure: Without restart, vulnerabilities remain exploitable in running processes

# Restart all dependent services
sudo systemctl restart nginx apache2 openvpn strongswan
sudo systemctl restart myapp

Are there workarounds if we can’t patch immediately?

Temporary mitigations (not substitutes for patching):

Network-level controls:

• Restrict QUIC traffic at firewall (if not required)
• Implement rate limiting on TLS connections
• Monitor for suspicious handshake patterns
• Disable DTLS if not actively used

Application-level controls:

• Reduce TLS session timeout values
• Implement connection limits per IP
• Monitor memory usage closely
• Log all TLS errors and anomalies

Important: These are temporary measures only. Patching is the only complete mitigation.

How do timing side-channel attacks work in this context?

Timing side-channel attacks exploit variations in cryptographic operation execution time:

1. Measurement: Attacker measures time required for signature generation or scalar multiplication
2. Correlation: Timing variations correlate with private key bits
3. Statistical analysis: Attacker collects thousands of timing samples
4. Key recovery: Statistical analysis reconstructs the complete private key

Example (SM2 on ARM64):

• Scalar multiplication time varies based on private key bit values
• Attacker measures time for each operation
• After 10,000–100,000 samples, attacker has sufficient information to recover the key
• Attacker can now forge signatures or decrypt communications

Mitigation: Constant-time implementations (provided in patched OpenSSL) eliminate timing variations.

References

Official Ubuntu Security Resources

• Ubuntu Security Notice: USN-8847-1
• Ubuntu Security Team: https://usn.ubuntu.com/
• Ubuntu Package Tracker: https://packages.ubuntu.com/

CVE References

• CVE-2026-35189 (CRL memory exhaustion)
• CVE-2026-35191 (QUIC amplification)
• CVE-2026-54872 (Elliptic curve timing leak)
• CVE-2026-54875 (SM2 ARM64/RISC-V timing leak)
• CVE-2026-72897 (SSL context switching OOB read)
• CVE-2026-75804 (QUIC flow control bypass)
• CVE-2026-75805 (CMP NULL pointer)
• CVE-2026-75806 (DTLS record validation)
• CVE-2026-77696 (SM2 signature timing leak)
• CVE-2026-84782 (DTLS retransmission)
• CVE-2026-84784 (RETIRECONNECTIONID handling)

OpenSSL Security Resources

• OpenSSL Security Advisory: https://www.openssl.org/news/secadv/
• OpenSSL Documentation: https://www.openssl.org/docs/

Additional Reading

• NIST Cryptographic Standards and Guidelines
• QUIC Protocol Specification (RFC 9000)
• DTLS 1.2 Specification (RFC 6347)
• Timing Side-Channel Attack Literature

Conclusion

USN-8847-1 represents a critical security update requiring immediate action. The combination of DoS vulnerabilities and information disclosure flaws creates significant risk for organizations running OpenSSL-dependent services. Ubuntu 26.04 LTS systems face elevated risk due to five exclusive vulnerabilities affecting QUIC protocol handling and cryptographic operations.

Key takeaways:

1. Patch immediately: Deploy updates within 24-48 hours
2. Prioritize Ubuntu 26.04 LTS: Elevated risk requires faster deployment
3. Restart services: Ensure updated libraries are loaded
4. Monitor continuously: Watch for exploitation attempts and anomalies
5. Test thoroughly: Verify functionality before production deployment

Organizations that act quickly to patch their systems will significantly reduce their exposure to these critical vulnerabilities.