OpenSSL Patches Nine Vulnerabilities Enabling Remote Denial-of-Service Attacks

OpenSSL published a 25 August 2026 advisory fixing nine vulnerabilities across QUIC, CMS, CMP, DTLS, TLS RPK and AEAD code paths — notable issues include a QUIC double-free (CVE-2026-18798) causing heap corruption and server termination, a CMS deterministic eight-byte out-of-bounds write, DTLS per-connection memory amplification, and several CMP crashes and memory-exhaustion bugs; administrators are advised to prioritize patching internet-facing QUIC/DTLS services and CMP servers, inventory statically linked libraries, and upgrade to the specified OpenSSL releases.