OpenSSL CVE-2026-18798

Exploitation requires the target to be running an OpenSSL-based application that has explicitly instantiated and exposed a QUIC server endpoint over UDP - this is an application-level, opt-in configuration, not the default for most OpenSSL consumers, which typically use TLS over TCP. The specific trigger is a QUIC INITIAL packet carrying a destination connection ID (DCID) field shorter than 8 bytes, violating RFC 9000's minimum length requirement for DCID. No authentication, prior session establishment, or user interaction is required; the malformed packet is processed before any connection state exists. Deployments using only TLS over TCP, or those running OpenSSL without QUIC server functionality active, are completely unaffected. FIPS module configurations are also excluded by design, as QUIC lies outside the FIPS boundary.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects a network-reachable, unauthenticated DoS with no complexity barrier for any organization running an OpenSSL-based QUIC server. SSVC rates exploitation as 'none' and technical impact as 'partial,' consistent with the vendor characterization of heap corruption leading to process termination rather than full compromise. Critically, SSVC rates the attack as 'Automatable: yes,' meaning an attacker can trivially scan and crash exposed QUIC endpoints at internet scale without per-target customization, which meaningfully elevates practical risk beyond what 'partial' technical impact might suggest. The RCE tag in the intelligence feed directly conflicts with the vendor's explicit statement that RCE is 'highly improbable'; this tag likely reflects conservative worst-case categorization from the tagging source and should not be treated as a confirmed code-execution risk. No EPSS score was provided in the input data, so exploitation probability against a base rate cannot be quantified. No CISA KEV listing exists and no public exploit code has been identified, consistent with SSVC's 'Exploitation: none' assessment. Net assessment: this is a genuine, readily triggerable DoS against QUIC-enabled deployments with a low barrier to trigger - timely patching is advisable for any organization actively serving QUIC traffic.

An unauthenticated attacker sends a single UDP QUIC INITIAL packet to an OpenSSL-based QUIC server with the destination connection ID (DCID) set to fewer than 8 bytes. This triggers the internal DCID length validation failure in ossl_quic_lcidm_enrol_odcid(), causing port_bind_channel() to free the QRX object on its error path before port_default_packet_handler() also frees it, corrupting the heap and crashing the server process. No public exploit code exists; however, the SSVC 'Automatable: yes' rating indicates the trigger condition is trivial to replicate at scale.