Why SolarWinds Observability Self-Hosted is not affected by multiple OpenSSL vulnerabilities

In 2026, the National Institute of Standards and Technology (NIST) published security bulletins about the following OpenSSL vulnerabilities:

NVD-CVE-2026-14456
NVD-CVE-2026-14457
NVD-CVE-2026-18798
NVD-CVE-2026-31789
NVD-CVE-2026-34182
NVD-CVE-2026-35191
NVD-CVE-2026-42772
NVD-CVE-2026-54873
NVD-CVE-2026-54875
NVD-CVE-2026-63073
NVD-CVE-2026-63075
NVD-CVE-2026-72897
NVD-CVE-2026-75803
NVD-CVE-2026-75804
NVD-CVE-2026-84784

CVE-2026-14456 is a denial-of-service (DoS) vulnerability in OpenSSL's QUIC server. When processing valid QUIC Initial packets for unknown destination connection IDs, the server can allocate incoming connection state without enforcing a limit. A remote attacker can send packets faster than the application accepts connections, causing excessive memory consumption and potentially making the QUIC listener unavailable.

CVE-2026-14457 is a denial-of-service vulnerability in OpenSSL's TLS implementation when RFC 7250 Raw Public Keys (RPKs) are enabled. If only a private key is configured without an associated certificate, a specially crafted TLS extension from a peer can trigger a NULL pointer dereference and terminate the application.

CVE-2026-18798 is a denial-of-service vulnerability in OpenSSL's QUIC server. If creation of a connection fails while processing an initial packet, the server may free the same internal QRX object twice, causing heap corruption and potentially terminating the server process.

CVE-2026-31789 is a heap buffer overflow vulnerability in OpenSSL's hexadecimal conversion of excessively large ASN.1 OCTET STRING values. On 32-bit platforms, integer overflow can cause an undersized buffer allocation when processing certain X.509 certificate extensions, potentially resulting in a crash or, under some conditions, code execution.

CVE-2026-34182 is a cryptographic integrity vulnerability in OpenSSL's Cryptographic Message Syntax (CMS) AuthEnvelopedData processing. Insufficient validation of cipher and authentication-tag parameters can allow forged messages to be accepted or integrity verification to be bypassed in affected decryption scenarios.

CVE-2026-35191 is a vulnerability in OpenSSL's QUIC server that can cause incorrect accounting of the permitted traffic amplification limit when address validation is disabled. A remote attacker who can spoof source addresses may exploit this behavior to make the server send more traffic than intended, potentially enabling a denial-of-service amplification attack.

CVE-2026-42772 is a denial-of-service vulnerability in OpenSSL's QUIC stream reassembly implementation. Processing out-of-order stream fragments can require quadratic time as the number of buffered fragments increases, allowing a remote peer with an established QUIC connection to consume excessive CPU resources.

CVE-2026-54873 is a denial-of-service vulnerability in OpenSSL's QUIC implementation. A remote peer can send crafted stream fragments that cause the QUIC stack to retain packet buffers longer than necessary, resulting in excessive memory consumption and potentially exhausting the server's resources.

CVE-2026-54875 is a timing and cache side-channel vulnerability in OpenSSL's SM2 cryptographic implementation on ARM64 and RISC-V platforms. The implementation uses secret-dependent branches and memory accesses during SM2 signing or decryption, potentially allowing an attacker with sufficiently precise timing or cache observations to infer secret key material.

CVE-2026-63073 is a format-string vulnerability in OpenSSL's Certificate Management Protocol (CMP) response validation. An attacker can supply a crafted sender distinguished name that is used as a format string without proper sanitization, potentially causing the CMP client to crash when processing a malicious response under affected configurations.

CVE-2026-63075 is a denial-of-service vulnerability in OpenSSL's QUIC implementation. The stack retains metadata for acknowledgment-only packets for the lifetime of a connection, even when the peer does not acknowledge them. A remote peer can exploit this behavior to cause excessive memory growth and potentially exhaust available memory.

CVE-2026-72897 is an out-of-bounds memory access vulnerability in OpenSSL's TLS server implementation. If an application calls SSL_set_SSL_CTX() during a handshake to switch to a context supporting more provider signature algorithms, the connection may access memory beyond an internal array, potentially causing a denial of service. Applications that do not switch SSL contexts during a handshake are not affected.

CVE-2026-75803 is a cryptographic integrity vulnerability in OpenSSL's AEAD decryption implementation. When EVP_Cipher() processes an empty ciphertext using ChaCha20-Poly1305 or AES-OCB, it may report success without verifying the supplied authentication tag, potentially allowing applications that rely on this result to accept forged messages.

CVE-2026-75804 is a denial-of-service vulnerability in OpenSSL's QUIC implementation. The stack enforces stream-level flow control but fails to enforce the connection-level limit, allowing a malicious remote peer to send substantially more data than intended and cause excessive memory consumption.

CVE-2026-84784 is a denial-of-service vulnerability in OpenSSL's QUIC implementation. The stack does not adequately limit the backlog of RETIRE_CONNECTION_ID frames, allowing a remote peer to cause unbounded resource consumption by generating excessive connection-ID retirement requests.

SolarWinds Observability Self-Hosted is not affected CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-31789, CVE-2026-34182, CVE-2026-35191, CVE-2026-42772, CVE-2026-54873, CVE-2026-54875, CVE-2026-63073, CVE-2026-63075, CVE-2026-72897, CVE-2026-75803, CVE-2026-75804, CVE-2026-84784.

CVE-2026-14456, CVE-2026-18798, CVE-2026-35191, CVE-2026-42772, CVE-2026-54873, CVE-2026-63075, CVE-2026-75804, CVE-2026-84784: SolarWinds Observability Self-Hosted does not use QUIC protocol functionality. The affected QUIC server, stream processing, flow-control, and connection management functionality is not in the execution path of the deployed product.

CVE-2026-14457: SolarWinds Observability Self-Hosted does not configure or use TLS Raw Public Keys as defined in RFC 7250. TLS connections rely on certificate-based authentication and trusted certificate authorities. The vulnerable Raw Public Key functionality is therefore not in the execution path of the deployed product.

CVE-2026-31789: SolarWinds Observability Self-Hosted does not use the affected 32-bit execution environment. The vulnerability is specific to the affected 32-bit implementation, and the vulnerable code path is not applicable to the deployed product.

CVE-2026-34182: SolarWinds Observability Self-Hosted does not use the affected OpenSSL CMS AuthEnvelopedData processing functionality. The vulnerable cryptographic message processing is therefore not in the execution path of the deployed product.

CVE-2026-75803: SolarWinds Observability Self-Hosted does not use the affected OpenSSL AEAD decryption functionality with ChaCha20-Poly1305 or AES-OCB. The vulnerable cryptographic operations are therefore not in the execution path of the deployed product.

CVE-2026-54875: SolarWinds Observability Self-Hosted does not use the affected SM2 cryptographic operations. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-63073: SolarWinds Observability Self-Hosted does not use the OpenSSL Certificate Management Protocol (CMP) functionality. The vulnerable CMP response-processing functionality is therefore not in the execution path of the deployed product.

CVE-2026-72897: SolarWinds Observability Self-Hosted does not use the affected OpenSSL libssl functionality that switches SSL contexts during a TLS handshake. Its TLS implementation does not invoke the vulnerable SSL_set_SSL_CTX() execution path. The vulnerable functionality is therefore not in the execution path of the deployed product.