High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL

OpenSSL and WolfSSL have each shipped fixes for roughly a dozen vulnerabilities, with several rated high severity. The most serious OpenSSL bug, CVE-2026-84782 (CVSS 8.2), affects applications using DTLS—common in VPN, VoIP and IoT software—and lets an unauthenticated remote peer leak fragments of heap memory in plaintext or crash the application during handshake retransmission. A second, medium-severity OpenSSL flaw, CVE-2026-84783, can crash multi-threaded TLS clients, while the remaining lower-severity issues cover DoS via resource exhaustion, QUIC-based DDoS amplification, and timing side-channels that could expose private keys. Separately, WolfSSL 5.9.4, released September 25, patches 11 vulnerabilities including three high-severity authentication-bypass issues—CVE-2026-93302, CVE-2026-89102 and CVE-2026-89136—that could let malicious servers or attackers holding a chained certificate forge identities or impersonate trusted peers in certain configurations. No exploitation in the wild has been reported for either library, but given their widespread use, administrators are advised to update promptly.