OpenSSL patched 16 flaws — the ones that reach you are exposed
OpenSSL's recent batch (June 2026) patched 16 flaws, including CVE-2026-45447 — a high-severity heap use-after-free in PKCS7_verify() that a crafted PKCS#7/S-MIME message can turn into remote code execution — and CVE-2026-34183, a QUIC denial-of-service that exhausts memory via flooded PATH_CHALLENGE frames. Updating OpenSSL is the fix; Veil does not patch the library. What Veil removes is the internet-reachability of the services that speak TLS and QUIC: cloak an exposed HTTPS or HTTP/3 endpoint and a remote attacker can't reach the vulnerable handshake to exploit it. It does not help against non-network vectors, like a malicious S/MIME message verified offline.
Frequently asked questions
Does Veil fix the OpenSSL vulnerability?
No. The fix is updating OpenSSL to a patched version — do that first. Veil removes something else: a remote attacker's ability to reach a vulnerable, internet-facing TLS or QUIC service at all. Cloak it and the exploit has nothing to connect to while you roll out the patch.
Which of these flaws does cloaking actually help with?
The network-reachable ones — anything an attacker triggers by connecting to your exposed TLS/HTTPS or QUIC/HTTP-3 endpoint, like the QUIC PATH_CHALLENGE denial-of-service. Cloaking removes that reachability. It does not help against vectors that don't arrive over a cloakable port, such as verifying a malicious S/MIME message locally.
We patch fast — why cloak too?
Patching is a race that starts the moment an advisory drops, and attackers are already scanning. A cloaked service was never in the scan, so the window between disclosure and your patch isn't an open door. Cloaking is defense in depth, not a replacement for patching.
Sources: OpenSSL — Vulnerabilities · NVD — CVE-2026-45447 · SecurityWeek — OpenSSL patches (found with AI)