USN-8678-3: OpenSSL DoS Vulnerabilities in Ubuntu 26.04 LTS — CVE-2026-75803 Missed-Fix Advisory, Detection and Remediation Guide

Canonical has issued USN-8678-3, a corrective OpenSSL update for Ubuntu 26.04 LTS, after discovering that the prior advisory (USN-8673-1) inadvertently shipped without the fix for CVE-2026-75803. This is the second time in recent memory the industry has been reminded that patching and patching completely are two different things — a regression window was left open on every Ubuntu 26.04 LTS system that applied the original update and considered itself remediated.

The advisory covers multiple denial-of-service conditions in OpenSSL affecting only Ubuntu 26.04 LTS:

• CVE-2026-14456 — OpenSSL incorrectly handles the QUIC server incoming channel queue, allowing a remote attacker to drive excessive resource consumption and cause a denial of service.
• CVE-2026-14457 — OpenSSL incorrectly handles signature algorithm selection when using Raw Public Keys (RPK), allowing a remote attacker to crash the process, causing a denial of service.
• CVE-2026-75803 — the fix omitted from USN-8673-1 and now delivered via USN-8678-3.

If your organization runs Ubuntu 26.04 LTS with TLS-terminating services — nginx, Apache, HAProxy, Envoy, Postfix, OpenVPN, or any application linked against libssl3 — you are in scope. DoS flaws in OpenSSL are rarely headline-grabbing, but for anything fronting production traffic, a remotely triggerable crash or resource-exhaustion condition is an availability incident waiting for a trigger.

Technical Analysis

Affected Products and Platforms

Per the advisory, these issues affect Ubuntu 26.04 LTS only. Systems running earlier LTS releases (24.04, 22.04) are not listed as affected. Any Ubuntu 26.04 LTS host that applied USN-8673-1 but has not yet applied USN-8678-3 is still carrying the unfixed CVE-2026-75803 code path.

Vulnerability Mechanics (Defender's View)

CVE-2026-14456 — QUIC incoming channel queue resource exhaustion. OpenSSL's QUIC server implementation fails to correctly manage the queue of incoming channels. A remote, unauthenticated attacker can send crafted QUIC traffic (UDP/443) to a server using OpenSSL's QUIC stack and force unbounded or excessive resource allocation — CPU burn, memory growth, or connection-slot exhaustion — until the service degrades or dies. Key exploitation notes:

• Requires the target service to be built with and listening on OpenSSL's QUIC server APIs (not all TLS daemons are — classic TCP/TLS listeners are not exposed to this specific path).
• No authentication required; network-reachable UDP/443 is sufficient.
• Observable symptom: memory/CPU climb in the affected daemon under sustained QUIC ingress without a corresponding legitimate session rate.

CVE-2026-14457 — Raw Public Key signature algorithm selection crash. When Raw Public Keys (RFC 7250-style certificate-less authentication) are negotiated, OpenSSL mishandles signature algorithm selection, and a remote attacker can steer the process into a crash. This is a classic NULL-deref / state-confusion class of bug triggered during handshake negotiation. Exploitation requirements:

• Target must have RPK enabled — this is a non-default configuration, which narrows the blast radius considerably. Standard X.509 certificate deployments are not exposed via this path.
• Unauthenticated, pre-handshake-completion trigger.
• Observable symptom: worker process segmentation faults (nginx/HAProxy/envoy workers dying) correlated with inbound handshake attempts.

CVE-2026-75803 — the fix that was left out of USN-8673-1 and is now shipped in USN-8678-3. The defensive lesson here is operational: an advisory marked 'applied' in your VMS does not mean the vulnerability is closed. Post-patch verification against package version — not advisory status — is the ground truth.

Severity and Exploitation Status

As of publication, Canonical has not assigned public CVSS scores for these CVEs, and there are no confirmed reports of in-the-wild exploitation or public PoC code, and none of these CVEs appear in CISA's Known Exploited Vulnerabilities catalog. These are denial-of-service conditions, not code execution — but OpenSSL sits in the data path of nearly every internet-facing service on a Linux host, so treat availability risk to edge services seriously and patch within your standard high-priority SLA.

Detection & Response

There is no exploit signature to detect here — the realistic detection surface is impact: TLS/QUIC daemons crashing or resource-starving under malformed handshake load, and QUIC floods against UDP/443. The highest-value 'detection' for this advisory is actually vulnerability verification: confirming which hosts are still running the incomplete patch level.

SIGMA Rules

---
title: OpenSSL-Linked TLS Daemon Crash Loop on Linux
description: Detects repeated segmentation faults or abnormal exits of TLS-terminating daemons linked against OpenSSL (nginx, apache2, haproxy, envoy, postfix), consistent with remote crash triggers such as CVE-2026-14457 (Raw Public Key signature algorithm selection crash) on Ubuntu 26.04 LTS.
id: 3c9f2a71-6b4d-4e18-9f2a-7d1c5b8e3a94
status: experimental
references:
  - https://ubuntu.com/security/notices/USN-8678-3
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.impact
  - attack.t1499
logsource:
  product: linux
  service: syslog
detection:
  selection_crash:
    - 'segfault'
    - 'general protection fault'
    - 'core dumped'
  selection_daemon:
    - 'nginx'
    - 'apache2'
    - 'haproxy'
    - 'envoy'
    - 'postfix'
    - 'caddy'
  condition: selection_crash and selection_daemon
falsepositives:
  - Legitimate daemon crashes from misconfiguration or resource limits — investigate frequency and correlation with inbound connection spikes
level: high
---
title: Systemd Service Repeated Restart of TLS-Terminating Daemons
description: Detects systemd repeatedly restarting OpenSSL-linked network services, indicating a crash loop potentially caused by remote denial-of-service attempts against OpenSSL on Ubuntu 26.04 LTS (CVE-2026-14456 / CVE-2026-14457).
id: 8e4b1d92-2f7a-4c65-b3d8-1a9e6c4f7b02
status: experimental
references:
  - https://ubuntu.com/security/notices/USN-8678-3
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.impact
  - attack.t1499
logsource:
  product: linux
  service: systemd
detection:
  selection:
    - 'Main process exited'
    - 'Failed with result'
    - 'start request repeated too quickly'
    - 'Scheduled restart job'
  selection_service:
    - 'nginx'
    - 'apache2'
    - 'haproxy'
    - 'envoy'
    - 'postfix'
    - 'openvpn'
  condition: selection and selection_service
falsepositives:
  - Rolling config reloads during deployments; filter against change windows
level: medium

KQL (Microsoft Sentinel / Defender)

Hunt for crash and restart evidence on Ubuntu hosts ingested via Syslog, and anomalous QUIC (UDP/443) ingress volume via firewall/CEF logs:

// Hunt 1: TLS daemon crashes / restart loops on Ubuntu 26.04 hosts (Syslog ingestion)
let daemons = dynamic(["nginx","apache2","haproxy","envoy","postfix","openvpn","caddy"]);
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("segfault", "general protection fault", "core dumped",
       "Main process exited", "start request repeated too quickly", "Failed with result")
| where SyslogMessage has_any (daemons)
| summarize CrashEvents = count(), DistinctMessages = make_set(SyslogMessage, 5)
    by Computer, ProcessName, bin(TimeGenerated, 1h)
| order by CrashEvents desc;

// Hunt 2: Anomalous UDP/443 (QUIC) connection volume targeting servers (CEF/firewall)
CommonSecurityLog
| where TimeGenerated > ago(6h)
| where DestinationPort == 443 and Protocol =~ "udp"
| summarize ConnCount = count(), Sources = dcount(SourceIP), TopSources = make_set(SourceIP, 10)
    by DestinationIP, bin(TimeGenerated, 15m)
| where ConnCount > 5000 or Sources > 200   // tune to baseline
| order by ConnCount desc;

Velociraptor VQL

The most important hunt is fleet-wide version verification — find every Ubuntu 26.04 host still running the incomplete OpenSSL package level:

-- Artifact: SecurityArsenal.Ubuntu.OpenSSL.USN8678-3.Check
-- Identify Ubuntu 26.04 hosts with OpenSSL packages not yet updated per USN-8678-3
SELECT Hostname,
       argv[0] AS Command,
       Stdout AS PackageVersions
FROM execve(argv=["/bin/bash", "-c",
       "echo \"=== dpkg -l openssl/libssl3 ===\"; dpkg -l | grep -E '^ii\s+(openssl|libssl3)'; echo \"=== openssl version ===\"; openssl version; echo \"=== os-release ===\"; grep PRETTY_NAME /etc/os-release"],
            length=100000)

Also hunt for crash artifacts (core dumps) of TLS daemons:

-- Artifact: SecurityArsenal.Linux.TLSDaemonCoreDumps
-- Locate recent core dumps from OpenSSL-linked daemons indicating remote crash triggers
SELECT FullPath, Mtime, Size
FROM glob(globs=["/var/lib/apport/coredump/*",
                 "/var/crash/*"])
WHERE FullPath =~ "nginx|apache2|haproxy|envoy|postfix|openvpn|caddy"
  AND Mtime > timestamp(epoch=now() - 86400*3)
ORDER BY Mtime DESC

Remediation Script (Bash)

Run this on Ubuntu 26.04 LTS hosts — or wrap it in your config management / Ansible — to apply USN-8678-3 and verify closure:

#!/usr/bin/env bash
# USN-8678-3 OpenSSL remediation + verification for Ubuntu 26.04 LTS
set -euo pipefail

# 1) Confirm platform scope — advisory only affects Ubuntu 26.04 LTS
. /etc/os-release
if [[ "${VERSION_ID}" != "26.04" ]]; then
  echo "[INFO] Not Ubuntu 26.04 LTS (${PRETTY_NAME}) — USN-8678-3 not applicable."
  exit 0
fi

# 2) Record pre-patch state
echo "[INFO] Pre-patch OpenSSL state:"
dpkg -l | grep -E '^ii\s+(openssl|libssl3)' || true
openssl version || true

# 3) Apply the corrective update
export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get install --only-upgrade -y openssl libssl3

# 4) Post-patch verification — the lesson of CVE-2026-75803: verify, don't assume
echo "[INFO] Post-patch OpenSSL state:"
dpkg -l | grep -E '^ii\s+(openssl|libssl3)'
openssl version

# 5) Verify via Ubuntu Security Notice tooling if available
if command -v ubuntu-security-status >/dev/null 2>&1; then
  ubuntu-security-status || true
fi

# 6) Restart dependent services — a patched libssl3 does nothing for daemons
#    still holding the old library mapped in memory
if command -v needrestart >/dev/null 2>&1; then
  needrestart -r a || true
else
  echo "[WARN] 'needrestart' not installed. Restart these service classes manually:"
  echo "       nginx apache2 haproxy envoy postfix dovecot openvpn caddy, and any"
  echo "       custom application linked against libssl3."
fi

echo "[INFO] USN-8678-3 remediation complete. Re-run 'openssl version' and package checks in your VMS."

Remediation

1. Patch immediately on all Ubuntu 26.04 LTS hosts. Apply the updated openssl / libssl3 packages per USN-8678-3 via apt-get install --only-upgrade openssl libssl3 (or Ubuntu Pro/esm-infra where applicable). Also confirm the original USN-8673-1 content is fully applied — hosts that skipped it entirely need both.
2. Re-audit hosts that 'already patched' under USN-8673-1. This is the critical takeaway of CVE-2026-75803: query installed package versions across your fleet (Ansible, Velociraptor, your VMS agent) — do not rely on advisory-applied flags. Any host at the USN-8673-1 package level is still vulnerable.
3. Restart all OpenSSL-linked services. Library upgrades do not take effect for running processes. Use needrestart or explicitly restart TLS/QUIC-terminating daemons and any long-running applications linked against libssl3.
4. Reduce exposure while patching:
   • If you are not using QUIC, block or rate-limit UDP/443 at the edge — this neutralizes the CVE-2026-14456 vector entirely for TCP-only TLS services.
   • Audit whether Raw Public Key (RPK) negotiation is enabled anywhere. It is non-default and rare; if you don't need it, ensure it's disabled, which removes the CVE-2026-14457 crash path.
5. Add crash-loop alerting. Wire the SIGMA/KQL detections above into your pipeline so a future remote-crash campaign against TLS daemons is visible in minutes, not after the outage page lights up.
6. Track in your VMS under all three CVEs (CVE-2026-75803, CVE-2026-14456, CVE-2026-14457) so scanners and dashboards reflect the true state. No CISA KEV deadline applies as of writing; use your high-severity DoS SLA for internet-facing assets.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub