SUSE Patches Five OpenSSL Flaws Affecting Enterprise Linux and Leap 15 Systems
SUSE has published advisory SUSE-SU-2026:5197-1, rated important, which resolves five vulnerabilities in the openssl-1_1 package along with one additional security fix. The affected CVEs are CVE-2026-35189, CVE-2026-54872, CVE-2026-75806, CVE-2026-77696 and CVE-2026-84782, with SUSE-assigned CVSS v3.1 scores ranging from 3.7 to 7.4 and CVSS v4.0 scores up to 8.3 for the most serious issue. The update applies to openSUSE Leap 15.5, SUSE Linux Enterprise Server 15 SP5 and its LTSS variant, SUSE Linux Enterprise Server for SAP Applications 15 SP5, SUSE Linux Enterprise High Performance Computing 15 SP5 including the ESPOS and LTSS channels, and SUSE Linux Enterprise Micro 5.5. Because OpenSSL 1.1 underpins TLS and cryptographic operations for a large share of system services on these platforms, the exposure is broad rather than confined to a single application. The fixed package version across all affected products is 1.1.1l-150500.17.68.1.
The advisory describes each flaw only at a summary level and does not publish exploitation details, proof-of-concept code or attack telemetry. CVE-2026-35189 is an excessive memory allocation condition in the handling of relative CRL distribution points, which maps to an availability-only impact in its CVSS vector. CVE-2026-75806 involves an unauthenticated and undersized DTLS 1.2 AEAD record that causes a denial of service, meaning a remote party can reach the defective parsing path without credentials. CVE-2026-84782 concerns DTLS retransmitting handshake messages from a stale buffer offset, and carries the highest rating in the set at 7.4 under CVSS v3.1 and 8.2 as scored by NVD, with confidentiality listed as the primary impact. The two remaining issues, CVE-2026-54872 and CVE-2026-77696, are timing side channels in scalar multiplication for non-NIST elliptic curves and in SM2 signature generation respectively, both rated at high attack complexity and limited confidentiality impact. Separately, the update adds the compiler flag -flive-patching=inline-clone to prevent untraceable inter-procedural optimisations that interfere with live patching tooling.
The practical significance of this update lies in where OpenSSL sits rather than in the individual scores. Services that terminate DTLS, such as VPN concentrators, real-time media gateways and certain IoT management stacks, are the components most directly in scope for the two DTLS defects, and these are frequently internet-facing by design. The stale buffer offset issue in CVE-2026-84782 is the one worth noting most, since retransmitting handshake data from an incorrect offset can place memory contents that were never intended for the peer onto the wire. The timing side channels are lower-probability concerns that require repeated, precisely measured observations of signing or key-exchange operations, and are mainly relevant to shared or multi-tenant hosts where an adversary can observe cryptographic timing closely. On current exploitation status, FIRST EPSS places all five vulnerabilities at low probability over the next thirty days: 0.4 percent for CVE-2026-35189, 0.5 percent for CVE-2026-54872, 1.2 percent for CVE-2026-75806, 0.5 percent for CVE-2026-77696 and 0.9 percent for CVE-2026-84782. No confirmed in-the-wild exploitation has been reported for any of them, and none appear in the CISA Known Exploited Vulnerabilities catalogue, so this is a scheduled maintenance item rather than an incident response trigger. The one operational wrinkle is that OpenSSL updates require dependent services to be restarted before the fixed library is actually in use, which means a patched package list alone does not prove a host is no longer running vulnerable code in memory.
Attack Surface
Server OS, Infrastructure
Tactics
Impact, Credential Access, Initial Access
Techniques
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Update openssl-1_1 and libopenssl1_1 to 1.1.1l-150500.17.68.1 on all affected hosts, including the 32-bit variants libopenssl1_1-32bit and libopenssl1_1-hmac-32bit on x86_64 systems where they are installed.
- Apply the product-specific patch with zypper: 'zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-5197' for SLES 15 SP5 LTSS, 'SUSE-SLE-Product-SLES_SAP-15-SP5-2026-5197' for SLES for SAP 15 SP5, 'SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-5197' and 'SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-5197' for HPC 15 SP5, 'SUSE-SLE-Micro-5.5-2026-5197' for SLE Micro 5.5, and 'SUSE-2026-5197' for openSUSE Leap 15.5.
- Run 'zypper ps -s' after patching to list processes still holding the old libcrypto/libssl 1.1 mappings, and restart those services so the fixed library is loaded in memory rather than only present on disk.
- Inventory DTLS-facing services first, since CVE-2026-75806 and CVE-2026-84782 are reachable over DTLS 1.2 without authentication. Prioritise OpenVPN, strongSwan, WebRTC and SIP media gateways, and CoAP endpoints linked against libopenssl1_1 on UDP listeners.
- Restrict exposure of DTLS listeners to known peer ranges at the firewall until the patched package is deployed, and alert on bursts of undersized or malformed DTLS records against those UDP ports as a proxy for exploitation attempts of CVE-2026-75806.
- For hosts performing SM2 signing or non-NIST elliptic curve operations, avoid co-locating untrusted workloads on the same physical host until the fix for CVE-2026-54872 and CVE-2026-77696 is applied, as both are timing side channels that require close observation of cryptographic operations.
- Validate that SLE Live Patching builds pick up the new -flive-patching=inline-clone compiler flag introduced for bsc#1277247, and confirm live patch application succeeds on kernels and libraries that previously failed due to untraceable inter-procedural optimisations.
