CVE-2026-75806

An established DTLS 1.2 session that employs an AEAD cipher suite can be crushed by a single unauthenticated datagram whose encrypted fragment is shorter than the required explicit IV and authentication tag overhead. This short record causes the cipher implementation to reject the length and the record layer raises a fatal internal_error alert, which in DTLS silently tears the association. The flaw does not affect memory safety, confidentiality, or integrity, but it does allow an attacker to degrade service for the targeted session.

The vulnerability affects systems that use OpenSSL to implement DTLS 1.2 with AEAD cipher suites. Version information is not explicitly provided, so any OpenSSL build that supports DTLS 1.2 and AEAD encryption is potentially impacted. Users should verify whether their deployment includes DTLS support and apply the available fix accordingly.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available and the CVE is not listed in the CISA KEV catalog, which reduces the immediacy of widespread exploitation. Attackers must be able to send directed small DTLS datagrams to a target that is actively using DTLS 1.2, meaning the attack is limited to the specific association and does not provide broader access or privilege escalation. Consequently, while the risk is moderate, the impact is confined to service interruption for individual connections.