diff --git a/deps/openssl/version.bzl b/deps/openssl/version.bzl
index 3d566795bae..ad2cee46e68 100644
--- a/deps/openssl/version.bzl
+++ b/deps/openssl/version.bzl
@@ -1 +1 @@
-OPENSSL_VERSION = "3.5.7"
+OPENSSL_VERSION = "3.5.8"
diff --git a/deps/repos.MODULE.bazel b/deps/repos.MODULE.bazel
index da4aa38b0f0..816a76091d7 100644
--- a/deps/repos.MODULE.bazel
+++ b/deps/repos.MODULE.bazel
@@ -107,20 +107,20 @@ http_archive(
     patch_strip = 1,
     # [sts] STAC-24773 B1 fix-up 3: patch 0002 dropped. It cherry-picks an
     # April 2026 upstream fix for OSSL_PARAM_BLD_push_octet_* NULL handling
-    # (openssl issue #30728); openssl-3.5.7 (bumped from 3.5.6 in commit
-    # 1740d83631 / STAC-25035) already incorporates that fix, so re-applying
-    # the patch fails with CONTENT_DOES_NOT_MATCH_TARGET at line 383. Surfaced
+    # (openssl issue #30728); every 3.5.x from 3.5.7 on already incorporates
+    # that fix, so re-applying the patch fails with
+    # CONTENT_DOES_NOT_MATCH_TARGET at line 383. Surfaced
     # by B1 because @rpm//:install is the first openscap-chain Bazel target
     # that transitively pulls @openssl — `//packages/agent/dependencies:install`
     # (the only Bazel target hit by STAC-24773's pre-B1 commits) doesn't.
     patches = [
         "//deps/openssl:0001-Set-the-install-name-to-use-rpath-instead-of-absolut.patch",
     ],
-    sha256 = "a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8",
-    strip_prefix = "openssl-3.5.7",
+    sha256 = "a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2",
+    strip_prefix = "openssl-3.5.8",
     urls = [
-        "https://dd-agent-omnibus.s3.amazonaws.com/bazel/openssl-3.5.7.tar.gz",
-        "https://www.openssl.org/source/openssl-3.5.7.tar.gz",
+        "https://dd-agent-omnibus.s3.amazonaws.com/bazel/openssl-3.5.8.tar.gz",
+        "https://www.openssl.org/source/openssl-3.5.8.tar.gz",
     ],
 )
 
diff --git a/exceptions/stackstate-k8s-agent/CVE-2026-14456.yaml b/exceptions/stackstate-k8s-agent/CVE-2026-14456.yaml
deleted file mode 100644
index d1ae29ad6cd..00000000000
--- a/exceptions/stackstate-k8s-agent/CVE-2026-14456.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-schema_version: '1'
-vulnerability:
-  id: CVE-2026-14456
-  severity: HIGH
-product:
-  consumer: stackstate-k8s-agent
-  image: quay.io/stackstate/stackstate-k8s-agent
-component:
-  purl: pkg:generic/openssl@3.5.7
-  paths:
-  - opt/stackstate-agent/embedded/lib/libssl.so.3
-  - opt/stackstate-agent/embedded/lib/libcrypto.so.3
-  - opt/stackstate-agent/embedded/bin/openssl
-status: accepted_pending_upstream_fix
-reason: no_upstream_fix_published
-expires: '2026-09-02'
-owner: "@StackVista/observability-team"
-upstream_owner: openssl
-upstream_reference: https://www.cve.org/CVERecord?id=CVE-2026-14456
-statement: |
-  Scanners report the fix as 3.5.8, 3.6.4 or 4.0.2. None of those exist: the
-  newest releases in each line are 3.5.7, 3.6.3 and 4.0.1, and OSV enumerates
-  all three as affected. The fix landed upstream on 2026-08-12 but has not been
-  released, so the advertised fixed versions are anticipated release numbers
-  rather than shipped tarballs. 3.5.7 is what we already pin and is the newest
-  3.5.x, so there is no bump to make.
-
-  The vulnerable path is the QUIC server listener accepting Initial packets for
-  unknown connection IDs. The agent is a client and runs no OpenSSL QUIC
-  listener, and the OpenSSL FIPS module is outside the affected boundary.
-
-  The date above is a short review deadline, not an acceptance -- re-check for
-  a released 3.5.x before renewing, and bump all four coordinated pins together
-  (deps/openssl/version.bzl, deps/repos.MODULE.bazel, and openssl3.rb).
-  Tracked in StackVista/stackstate-agent#489.
diff --git a/omnibus/config/software/openssl3.rb b/omnibus/config/software/openssl3.rb
index 6a5e103c464..14d96e28440 100644
--- a/omnibus/config/software/openssl3.rb
+++ b/omnibus/config/software/openssl3.rb
@@ -28,10 +28,10 @@
 # STAC-24773 D1 in python3.rb / datadog-agent-dependencies.rb). zlib is now
 # installed inline via @zlib//:install and is no longer an omnibus dependency.
 #
-# Version is kept at 3.5.7 to match deps/openssl/version.bzl (STS is a patch
-# release ahead of upstream base-7.78.2's 3.5.6; bumped in commit 42e0e0b8bf
-# for CVE-2025-9230 / openssl issue #30728).
-default_version "3.5.7"
+# Must match deps/openssl/version.bzl — the Bazel repo rule is what actually
+# builds OpenSSL, and a divergence here silently reports the wrong version.
+# STS runs ahead of upstream base-7.78.2's 3.5.6 to carry CVE fixes.
+default_version "3.5.8"
 
 relative_path "openssl-#{version}"
 
diff --git a/releasenotes/notes/cve-2026-14456-openssl-3-5-8-4f1a9c2d7b3e6058.yaml b/releasenotes/notes/cve-2026-14456-openssl-3-5-8-4f1a9c2d7b3e6058.yaml
new file mode 100644
index 00000000000..1e11fb4b6ba
--- /dev/null
+++ b/releasenotes/notes/cve-2026-14456-openssl-3-5-8-4f1a9c2d7b3e6058.yaml
@@ -0,0 +1,6 @@
+---
+security:
+  - |
+    Upgrade the embedded OpenSSL to 3.5.8, addressing ``CVE-2026-14456``
+    (unbounded memory growth in the QUIC server incoming channel queue) along
+    with the other CVEs fixed in that release.