-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-26:61.openssl Security Advisory
The FreeBSD Project
Topic: Multiple vulnerabilities in OpenSSL
Category: contrib
Module: openssl
Announced: 2026-08-25
Credits: See linked vendor advisory in References section
Affects: All supported versions of FreeBSD.
Corrected: 2026-08-25 15:59:51 UTC (stable/15, 15.1-STABLE)
2026-08-25 16:01:28 UTC (releng/15.1, 15.1-RELEASE-p3)
2026-08-25 16:01:08 UTC (releng/15.0, 15.0-RELEASE-p13)
2026-08-25 16:00:02 UTC (stable/14, 14.4-STABLE)
2026-08-25 16:00:29 UTC (releng/14.4, 14.4-RELEASE-p9)
CVE Name: CVE-2026-14457, CVE-2026-18798, CVE-2026-54874,
CVE-2026-63072, CVE-2026-63073, CVE-2026-63074,
CVE-2026-63075, CVE-2026-63076
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is a
collaborative effort to develop a robust, commercial-grade, full-featured
Open Source toolkit for the Transport Layer Security (TLS) protocol. It is
also a general-purpose cryptography library.
II. Problem Description
Multiple issues have been reported as part of this advisory with different
issues affecting different OpenSSL versions and therefore different FreeBSD
versions. Instead of exhaustively listing detailed writeups for each issue,
please see the referenced advisory from OpenSSL.
Issues affecting FreeBSD 15.x (OpenSSL 3.5):
CVE-2026-14457 - Handshake failure with raw public key configurations
CVE-2026-18798 - Double free in the QUIC server packet handler
CVE-2026-54874 - Excessive memory use buffering DTLS next-epoch records
CVE-2026-63072 - Heap buffer overflow in AES-WRAP-PAD unwrap
CVE-2026-63073 - Format string injection via CMP sender name
CVE-2026-63074 - Unbounded certificate cache growth in the CMP server
CVE-2026-63075 - Unbounded QUIC memory growth from ACK-only frames
CVE-2026-63076 - NULL dereference via crafted CMP protectionAlg
Issues affecting FreeBSD 14.x (OpenSSL 3.0):
CVE-2026-54874 - Excessive memory use buffering DTLS next-epoch records
CVE-2026-63072 - Heap buffer overflow in AES-WRAP-PAD unwrap
CVE-2026-63074 - Unbounded certificate cache growth in the CMP server
CVE-2026-63076 - NULL dereference via crafted CMP protectionAlg
III. Impact
The issues include a heap buffer overflow, a double free, a format string
injection, a NULL pointer dereference, and several paths that allow a remote
peer to force unbounded memory allocation.
Security impact ranges from a Denial of Service to a potential remote code
execution. See the OpenSSL advisory for specific details.
IV. Workaround
No workaround is available.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Perform one of the following:
1) To update your vulnerable system installed from base system packages:
Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
arm64 platforms, which were installed using base system packages, can be
updated via the pkg(8) utility:
# pkg upgrade -r FreeBSD-base
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system installed from binary distribution sets:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
which were not installed using base system packages can be updated via the
freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 15.x]
# fetch https://security.FreeBSD.org/patches/SA-26:61/openssl-15.patch
# fetch https://security.FreeBSD.org/patches/SA-26:61/openssl-15.patch.asc
# gpg --verify openssl-15.patch.asc
[FreeBSD 14.x]
# fetch https://security.FreeBSD.org/patches/SA-26:61/openssl-14.patch
# fetch https://security.FreeBSD.org/patches/SA-26:61/openssl-14.patch.asc
# gpg --verify openssl-14.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch -E -p0 < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart all daemons that use the library, or reboot the system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/15/ c5ad29cb6c62 stable/15-n285146
releng/15.1/ 2fdcba9f607e releng/15.1-n283608
releng/15.0/ ae2c9e5bba0a releng/15.0-n281111
stable/14/ 9e9609ab9c5c stable/14-n275047
releng/14.4/ 275b424d3cc2 releng/14.4-n273763
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
<URL:https://openssl-library.org/news/secadv/20260825.txt>
<URL:https://www.cve.org/CVERecord?id=CVE-2026-14457>
<URL:https://www.cve.org/CVERecord?id=CVE-2026-18798>
<URL:https://www.cve.org/CVERecord?id=CVE-2026-54874>
<URL:https://www.cve.org/CVERecord?id=CVE-2026-63072>
<URL:https://www.cve.org/CVERecord?id=CVE-2026-63073>
<URL:https://www.cve.org/CVERecord?id=CVE-2026-63074>
<URL:https://www.cve.org/CVERecord?id=CVE-2026-63075>
<URL:https://www.cve.org/CVERecord?id=CVE-2026-63076>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-26:61.openssl.asc>
-----BEGIN PGP SIGNATURE-----
iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3YYbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvHBEQANgE49OnP3fjcOpfHnGq
Z/EN9UdZQ1E45/mKvcDVuai6uG8kQIg+FXDCtOfUzbgAgzOnt6MAWVdg6C6Zq+mJ
rIZCwqMu4VukiDQb9GjXg6hrnGQGQ31Tx285yxr3X/aPTm78s2yVTEbHldH+XFrk
NMY3q+ibtawbmlBSKiG7DLthTqQR1D4p4H82zv5m41fS2lAos5bos3l0cu7T0lfr
ZFd227sHHYqhMZzHCg5RjeTzcsNfvl8fHE6fyDfKemfs6ixyPa1a++KsGi5gX4mn
tGB0TcA1aMVTEmRiXK4d7hvxypgok+Y1UbxN2y8P6CrxaR7+HSg4lYOWMDdhX0Bs
Vv8Mlp+NTqbugsSuOWRYB6zSALgv7RecgVyJ78JKxuG2uN7TUqfU5kwaGZezO56E
/JzlYHRROcJtI5gLbGb6uwY3PLd/z0muWG7zlHMDxV/GwbpqV/am6oBusSYSEuEr
WCzaTjqatL1KX1R1RbxuBC2TIjvO04nq+CCpGwW/IMJWZksL/06fkpmSRFHH2zpe
f4a1h1BJ55q4xHhRQZlftyWbsFx3NpS6LwUYlzakbfFvTFhpB+yZtTQg9Cal0Wog
SBwJyvNa27QYGn15EyJSkwsJ49lnrWZL83ez0S2mpGchwhihE9DD7eX8QLr0sl0s
pHwlm2Cp31wk+VMTVrXG29RX
=6jpF
-----END PGP SIGNATURE-----