Ubuntu USN · USN-8625-1

OpenSSL vulnerability

Published: Thu, 30 Jul 2026 13:38

Summary

OpenSSL could be made to crash if it received specially crafted network traffic.

Details

It was discovered that OpenSSL incorrectly allocated memory buffers in the SSL/TLS state machine when receiving handshake data. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. This issue is known as the "HollowByte" denial of service.

Recommended actions per Ubuntu release

StackPatch playbook auto-generated per release codename and per affected package.

Ubuntu jammy

openssl→3.0.2-0ubuntu1.26apt_upgrade
Standard apt upgrade. Install 3.0.2-0ubuntu1.26 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y openssl
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libssl-dev→3.0.2-0ubuntu1.26apt_upgrade
Standard apt upgrade. Install 3.0.2-0ubuntu1.26 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libssl-dev
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libssl-doc→3.0.2-0ubuntu1.26apt_upgrade
Standard apt upgrade. Install 3.0.2-0ubuntu1.26 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libssl-doc
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libssl3→3.0.2-0ubuntu1.26apt_upgrade
Standard apt upgrade. Install 3.0.2-0ubuntu1.26 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libssl3
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
openssl→3.0.2-0ubuntu1.26apt_upgrade
Standard apt upgrade. Install 3.0.2-0ubuntu1.26 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y openssl
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Ubuntu noble

openssl→3.0.13-0ubuntu3.12apt_upgrade
Standard apt upgrade. Install 3.0.13-0ubuntu3.12 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y openssl
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libssl-dev→3.0.13-0ubuntu3.12apt_upgrade
Standard apt upgrade. Install 3.0.13-0ubuntu3.12 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libssl-dev
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libssl-doc→3.0.13-0ubuntu3.12apt_upgrade
Standard apt upgrade. Install 3.0.13-0ubuntu3.12 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libssl-doc
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libssl3t64→3.0.13-0ubuntu3.12apt_upgrade
Standard apt upgrade. Install 3.0.13-0ubuntu3.12 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libssl3t64
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
openssl→3.0.13-0ubuntu3.12apt_upgrade
Standard apt upgrade. Install 3.0.13-0ubuntu3.12 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y openssl
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Ubuntu resolute

openssl→3.5.5-1ubuntu3.3apt_upgrade
Standard apt upgrade. Install 3.5.5-1ubuntu3.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y openssl
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libssl-dev→3.5.5-1ubuntu3.3apt_upgrade
Standard apt upgrade. Install 3.5.5-1ubuntu3.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libssl-dev
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libssl-doc→3.5.5-1ubuntu3.3apt_upgrade
Standard apt upgrade. Install 3.5.5-1ubuntu3.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libssl-doc
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
libssl3t64→3.5.5-1ubuntu3.3apt_upgrade
Standard apt upgrade. Install 3.5.5-1ubuntu3.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y libssl3t64
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
openssl→3.5.5-1ubuntu3.3apt_upgrade
Standard apt upgrade. Install 3.5.5-1ubuntu3.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y openssl
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
openssl-provider-legacy→3.5.5-1ubuntu3.3apt_upgrade
Standard apt upgrade. Install 3.5.5-1ubuntu3.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y openssl-provider-legacy
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Are YOU affected by USN-8625-1?

5-second check on your actual server. Reads /etc/os-release, uname -r, and dpkg-query; matches against the live USN + Debian Security Tracker feeds; tells you whether USN-8625-1 (and any other live CVE) applies. Anonymous, no signup.

curl https://mindsparkstack.com/scan.sh | bash

Form-based quickscan Read the bash source first

References

Want this automated for your servers?

StackPatch runs this match against YOUR installed packages every hour

Free (3 servers) / from $9/mo (14-day free trial) / Solo $9/mo / Pro $29/mo / Team $79/mo. Indie pricing.

Start free trial →See StackPatch →Live audit log →