It was discovered that OpenSSL incorrectly handled the QUIC server incoming channel queue. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-14456 ) It was discovered that OpenSSL incorrectly handled signature algorithm selection when using Raw Public Keys. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-14457 ) It was discovered that OpenSSL incorrectly handled QUIC INITIAL packet processing. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-18798 ) It was...
It was discovered that OpenSSL incorrectly handled the QUIC server incoming channel queue. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-14456 )
It was discovered that OpenSSL incorrectly handled signature algorithm selection when using Raw Public Keys. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-14457 )
It was discovered that OpenSSL incorrectly handled QUIC INITIAL packet processing. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-18798 )
It was discovered that OpenSSL incorrectly handled the QUIC server incoming channel queue. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-14456 ) It was discovered that OpenSSL incorrectly handled signature algorithm selection when using Raw Public Keys. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-14457 ) It was discovered that OpenSSL incorrectly handled QUIC INITIAL packet processing. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-18798 ) It was discovered that OpenSSL incorrectly handled buffering of DTLS records for a future epoch. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. ( CVE-2026-54874 ) It was discovered that OpenSSL incorrectly handled CMS key unwrapping. A remote attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial of service or arbitrary code execution. ( CVE-2026-63072 ) It was discovered that OpenSSL incorrectly validated the sender distinguished name in CMP response messages. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-63073 ) It was discovered that OpenSSL incorrectly limited the growth of an internal certificate cache used during CMP operations. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. ( CVE-2026-63074 ) It was discovered that OpenSSL incorrectly handled QUIC ACK-only packet retention. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-63075 ) It was discovered that OpenSSL incorrectly handled CMP protection algorithm validation. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. ( CVE-2026-63076 ) It was discovered that OpenSSL incorrectly verified authentication tags when using certain AEAD ciphers via the EVP_Cipher() interface. An attacker could possibly use this issue to perform AEAD forgery attacks. ( CVE-2026-75803 )
It was discovered that OpenSSL incorrectly handled the QUIC server incoming channel queue. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-14456 )
It was discovered that OpenSSL incorrectly handled signature algorithm selection when using Raw Public Keys. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-14457 )
It was discovered that OpenSSL incorrectly handled QUIC INITIAL packet processing. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-18798 )
It was discovered that OpenSSL incorrectly handled buffering of DTLS records for a future epoch. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. ( CVE-2026-54874 )
It was discovered that OpenSSL incorrectly handled CMS key unwrapping. A remote attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial of service or arbitrary code execution. ( CVE-2026-63072 )
It was discovered that OpenSSL incorrectly validated the sender distinguished name in CMP response messages. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-63073 )
It was discovered that OpenSSL incorrectly limited the growth of an internal certificate cache used during CMP operations. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. ( CVE-2026-63074 )
It was discovered that OpenSSL incorrectly handled QUIC ACK-only packet retention. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. ( CVE-2026-63075 )
It was discovered that OpenSSL incorrectly handled CMP protection algorithm validation. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. ( CVE-2026-63076 )
It was discovered that OpenSSL incorrectly verified authentication tags when using certain AEAD ciphers via the EVP_Cipher() interface. An attacker could possibly use this issue to perform AEAD forgery attacks. ( CVE-2026-75803 )
After a standard system update you need to reboot your computer to make all the necessary changes.
The problem can be corrected by updating your system to the following package versions:
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
