OpenSSL Security Patches Fix Remote Code Execution Risk

OpenSSL has released emergency security updates to fix multiple memory-safety flaws in its certificate and QUIC-related code paths, including a use-after-free that can be triggered remotely and lead to Remote Code Execution via CVE-2026-45447. The release also covers additional security issues such as input-validation weaknesses (CVE-2026-34182), nonce handling problems in AES-OCB one-shot operations (CVE-2026-45445), and denial-of-service and crash conditions in the QUIC stack (CVE-2026-34183, CVE-2026-42764, CVE-2026-42765) plus an OCSP stapling double-free hazard (CVE-2026-35188). OpenSSL users are urged to upgrade promptly—e.g., from version 4.0 to version 4.0.1, and from 1.1.1 to 1.1.1zh—because unauthenticated attackers may be able to exploit these problems over the network.