CVE-2026-75806

Name of the Vulnerable Software and Affected Versions (affected versions not specified)

Description An issue exists in the handling of DTLS 1.2 associations using an AEAD (Authenticated Encryption with Associated Data) cipher suite. An attacker can terminate an established association by sending a single unauthenticated datagram where the encrypted fragment is shorter than the required explicit IV (Initialization Vector) and authentication tag overhead. This occurs because the record layer passes the record length to the cipher implementation before verifying if the record is long enough to contain the explicit IV and tag. Consequently, the cipher implementation rejects the length, and the record layer triggers a fatal internal error alert instead of treating it as an authentication failure. This results in a Denial of Service (DoS) limited to the targeted association.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.