SUSE has released updates for OpenSSL to address multiple vulnerabilities that affect SUSE Linux Enterprise Server for SAP Applications 15 SP4. The vulnerabilities include issues such as DTLS retransmitting handshake messages from a stale buffer offset, excessive memory allocation in relative CRLDP processing, and a timing side-channel in scalar multiplication for non-NIST EC curves.
The specific vulnerabilities addressed are CVE-2026-84782, CVE-2026-35189, CVE-2026-54872, CVE-2026-75806, and CVE-2026-77696. Among these, CVE-2026-84782 has been assigned a CVSS score of 7.4, indicating a higher severity, while CVE-2026-35189 and CVE-2026-54872 have CVSS scores of 5.3 and 3.7, respectively.
CVE-2026-75806 involves an unauthenticated and undersized DTLS 1.2 AEAD record that can cause a denial of service, while CVE-2026-77696 relates to a timing side-channel in SM2 signature generation. Exploitation of these vulnerabilities has been reported.
Organizations using SUSE Linux Enterprise Server for SAP Applications 15 SP4 are advised to apply the updates provided by SUSE to mitigate the risks associated with these vulnerabilities.