CVE-2026-75806

/// Technical description

Issue summary: An established DTLS 1.2 association using an AEAD cipher suite

can be terminated by a single unauthenticated datagram whose encrypted

fragment is shorter than the mandatory explicit IV and authentication tag

overhead.

Impact summary: An attacker who can send a datagram that is routed to an

existing DTLS 1.2 association can tear that association down without knowing

any key material. This is a Denial of Service limited to the targeted

association. There is no memory safety or confidentiality impact.

CWE: CWE-1284: Improper Validation of Specified Quantity in Input

Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher

suite carries an explicit IV followed by the ciphertext and an authentication

tag. When decrypting such a record the record layer passed the record length to

the cipher implementation before checking that the record was long enough to

contain the explicit IV and the tag. For a record shorter than that overhead the

cipher implementat

/// Remediation

Check the references section for vendor advisories and patches from openssl. Update openssl to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References