OpenSSL and WolfSSL have released security fixes for roughly a dozen flaws each, including bugs that could let attackers crash systems, leak memory, or bypass certificate-based identity checks. OpenSSL fixed 14 issues led by CVE-2026-84782, a high-severity Datagram TLS flaw that can expose heap memory or cause denial of service during the handshake, plus CVE-2026-84783 affecting multithreaded TLS clients. WolfSSL 5.9.4 fixes 11 issues, including high-severity CVE-2026-93302, CVE-2026-89102, and CVE-2026-89136, which can let a malicious server bypass peer authentication in certain configurations used with Nginx, HAProxy, Stunnel, and Apache httpd.
Why it matters: These libraries sit underneath many products, so even configuration-dependent bugs can ripple into VPNs, web servers, proxies, VoIP, and embedded devices. Organizations and vendors using OpenSSL or WolfSSL should update quickly and review whether affected DTLS or certificate-validation features are enabled.
Eduard Kovacs
2026.09.30
100% relevant
This article establishes a distinct patch cycle covering new 2026 OpenSSL and WolfSSL flaws, with different CVEs and affected behaviors than previously tracked OpenSSL stories.
← Back to all stories