CVE-2026-84783: OpenSSL use-after-free in X.509 extension caching

CVE-2026-84783 · Severity: high · CVSS 7.5 · Published 2026-09-29

OpenSSL 4.0 contains a flaw in how it caches X.509 certificate extension data when multiple threads access the same trusted certificate simultaneously. An attacker can trigger a use-after-free condition in multi-threaded TLS clients or servers, causing the application to crash and resulting in a denial of service.

Technologies: OpenSSL. Vendors: OpenSSL.

Quick answers

Is CVE-2026-84783 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84783 being exploited in the wild.
How severe is CVE-2026-84783?
High severity, with a CVSS score of 7.5, published 29 September 2026.
Which products and versions are affected?
OpenSSL 4.0, before 4.0.3.
Is there a fix for CVE-2026-84783?
A patch was published on 2026-09-29: OpenSSL 4.0.3 release fixes the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84783 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-84783?
Check whether you run OpenSSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition exists in OpenSSL 4.0's certificate extension caching mechanism: extensions are computed under a read lock, then installed under a write lock. Multiple threads can compute the cache concurrently, and each write installation frees the previous values despite other threads still holding pointers to them. This use-after-free affects shared trusted CA certificates during the first certificate chain verification, triggered when multiple connections simultaneously build chains to the same CA.

Affected products

  • OpenSSL OpenSSL 4.0, before 4.0.3

Timeline

  • 2026-08-27: disclosed: Reported by Tim Becker (Xint.io)
  • 2026-08-31: disclosed: Independently reported publicly by aydinmercan
  • 2026-09-29: patched: OpenSSL 4.0.3 release fixes the issue
  • 2026-09-29: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.