Ubuntu USN-8861-1 Fixes OpenSSL Vulnerabilities
Tech GuruQuick Answer
Ubuntu USN-8861-1 fixes two OpenSSL QUIC denial-of-service issues on Ubuntu 26.04 LTS. Update the affected binary packages, including libssl3t64 3.5.5-1ubuntu3.7, then reboot as Canonical instructs. Updating only an openssl command-line tool is not proof that all applications use the fixed library.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory OpenSSL vulnerabilities on Ubuntu 26.04 LTS (resolute), match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-10-01 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | OpenSSL vulnerabilities on Ubuntu 26.04 LTS (resolute) |
|---|---|
| Advisory | USN-8861-1 |
| CVEs | CVE-2026-42772, CVE-2026-54873 |
| Authoritative release date | 2026-10-01 12:02:00.813908 UTC |
| Authority revision date | No separate material revision date is stated by Ubuntu; verified against the first-party notice API. |
| Affected versions | The Ubuntu releases and source packages enumerated in USN-8861-1: Ubuntu 26.04 LTS (resolute). |
| Fixed source build (not an install command) | resolute: openssl 3.5.5-1ubuntu3.7 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
CVE-2026-42772 concerns inefficient QUIC stream reassembly that can consume excessive CPU. CVE-2026-54873 concerns insufficient limits on QUIC packet-buffer memory. Both are remote resource-exhaustion risks; this notice does not establish that every TLS service enables the affected QUIC path.
Fixed Binary Packages
Canonical's notice API lists these visible binary fixes. Match installed packages; this is not an instruction to install every listed package.
- resolute:
libssl3t64 3.5.5-1ubuntu3.7.
What To Validate Now
- Inventory. Locate OpenSSL vulnerabilities on Ubuntu 26.04 LTS (resolute) deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match the installed Ubuntu release and binary packages to USN-8861-1. The source build identifies packaging provenance; it is not necessarily an installable package name. Do not transfer a version from another release or assume bundled upstream software is covered.
- Remediate. Update the installed affected binary packages through the supported Ubuntu security or applicable Pro/ESM repository for that release. Use the USN package table, not the source-package name as an installation command. Keep the Ubuntu version epoch and suffix when checking the fixed build.
- Validate. Confirm the installed binary versions and completed reboot, then verify required services return and normal TLS/QUIC workflows succeed where used. Check application-bundled OpenSSL separately; the host library update does not prove those copies changed.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The listed fix is in resolute's security pocket. Plan the reboot with service owners and verify recovery access first. The USN states no active exploitation; do not turn either resource-exhaustion description into a claim of compromise.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
