RHSA-2026:56097HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
August 18, 2026
Last Modified
October 22, 2026

🔗 CVE IDs covered (2)

CVE-2026-54876 →CVE-2026-14456 →

📋 Description

CVE-2026-14456 — openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-54876 — openssl: openssl-src: OpenSSL: Memory leak leads to Denial of Service in OCSP response checking

🎯 Affected products16

  • Red Hat Hardened Images
  • openssl-1:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssl-1:3.5.6-0.5.hum1@src as a component of Red Hat Hardened Images
  • openssl-1:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssl-config-fips-1:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssl-config-fips-1:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssl-devel-1:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssl-devel-1:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssl-devel-engine-1:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssl-devel-engine-1:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssl-fips-provider-upstream-1:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssl-fips-provider-upstream-1:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssl-libs-1:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssl-libs-1:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images
  • openssl-perl-1:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images
  • openssl-perl-1:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Option 1: Rate-limit or Firewall Inbound QUIC (UDP 443) [Goal: Slow or block QUIC Initial packets before they reach the vulnerable listener.] A. Confirm QUIC Exposure - Check if any service is listening on UDP 443: ~~~ $ ss -ulnp | grep ':443' # or $ sudo lsof -iUDP:443 -n -P ~~~ Note: If no service is listening on UDP 443, this CVE does not apply (TCP 443 is unaffected). B. Restrict Access to UDP 443 ( Default-deny UDP 443 and allow only trusted networks:) ~~~ $ sudo firewall-cmd --permanent --remove-service=quic 2>/dev/null $ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="443" protocol="udp" accept' $ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="443" protocol="udp" drop' $ sudo firewall-cmd --reload ~~~ C. Verify - Confirm the restriction by testing from an external host (the connection should fail or be throttled): ~~~ $ nc -u -v YOUR_HOST 443 ~~~ Option 2: Disable QUIC Server If QUIC/HTTP3 is not required, remove the vulnerable code path entirely and use TLS/TCP instead. Recommended Mitigation Priority Priority : Action 1.Confirm UDP 443 QUIC listener exists and OpenSSL version is in affected range 2.Block or rate-limit UDP 443 at firewall/edge (immediate) 3.Disable QUIC/HTTP3 on the service if not needed 4.Upgrade OpenSSL to fixed release when available 5.Application owners: set SSL_VALUE_QUIC_MAX_PENDING_CONNS if default 256 is too high Workaround: No broadly applicable mitigation is available. If an affected client application provides a configuration setting for OCSP response checking, operators can temporarily disable it where their certificate revocation policy permits. This blocks the vulnerable response-checking path but removes OCSP-based revocation checks. Clients that must keep OCSP response checking enabled remain exposed.

🔗 References (6)