Skip to main content

OpenSSL CVE-2026-42772

| EUVDEUVD-2026-89003 MEDIUM
Inefficient Algorithmic Complexity (CWE-407)
2026-09-29 GHSA-5r49-x3jp-qp9h
OpenSSL
5.3
CVSS 3.1 · Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach OpenSSL QUIC endpoint over network
  2. Delivery
    Send crafted fragmented QUIC frames
  3. Exploit
    Trigger O(n^2) reassembly path
  4. Execution
    Exhaust CPU on target
  5. Impact
    Degrade or deny service availability

Vulnerability Assessment

Weakness
CWE
CWE-407
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
Exploitation Conditions

Exploitation requires the target application to use OpenSSL's QUIC implementation (a relatively new code path, not engaged by traditional TLS/DTLS-only deployments) in affected versions (3.4.0<3.4.8, 3.5.0<3.5.9, 3.6.0<3.6.5, 4.0.0<4.0.3). The attacker must be able to send QUIC protocol fragments to the endpoint and craft them to drive the reassembly logic into its O(n^2) worst case. No authentication (PR:N) and no user interaction (UI:N) are needed, and the attack is network-reachable (AV:N). The principal limiting factor is QUIC adoption: deployments that do not enable OpenSSL QUIC are unaffected, which sharply narrows the real-world attack surface despite OpenSSL's ubiquity; impact is bounded to availability degradation (A:L), not crash, code execution, or data exposure.
Impact

This is a moderate-severity denial-of-service issue, not a high-impact flaw despite OpenSSL's ubiquity. The CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) correctly reflects CWE-407 (inefficient algorithmic complexity, O(n^2) QUIC fragment reassembly): remotely reachable, no auth, no user interaction, but impact limited to availability only (C:N/I:N) with partial (A:L) rather than full service crash. SSVC alignment is consistent and informative: Exploitation=none (no known in-the-wild activity), Automatable=yes (reachable at scale, no auth gate), Technical Impact=partial - this maps to a CISA 'Track' disposition, i.e. patch on normal cycle rather than emergency. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active exploitation: no public exploit identified at time of analysis. The one notable caveat is applicability - the flaw lives in OpenSSL's QUIC stack, which is a comparatively new and not-yet-universally-adopted code path, so the realistic attack surface is far narrower than OpenSSL's overall footprint. Net: a real but low-urgency bug; a CPU-exhaustion DoS, not a high-CVSS-but-fake-risk issue nor a critical priority.
Exploit ScenarioDerived

An attacker establishes or participates in a QUIC connection with a server or client built on OpenSSL's QUIC implementation and sends a specially crafted sequence of overlapping or out-of-order protocol fragments. The victim's reassembly logic degrades to O(n^2), consuming excessive CPU and degrading or stalling service. No authentication or user interaction is required, but no public exploit code was provided and exploitation is unproven.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 01, 2026

Denial of service via CPU exhaustion in OpenSSL's QUIC stack allows unauthenticated remote attackers to degrade availability on endpoints that accept QUIC traffic, by sending crafted fragmented data that forces the fragment reassembly logic into its O(n^2) worst case. Affected builds are OpenSSL 3.4.0 through 3.4.7, 3.5.0 through 3.5.8, 3.6.0 through 3.6.4 and 4.0.0 through 4.0.2, and only deployments with QUIC enabled are reachable, so classic TLS/DTLS-only users are unaffected. Impact is limited to partial availability loss (CVSS 5.3, A:L, CWE-407); CISA's SSVC records exploitation as 'none' and no public exploit code has been identified at time of analysis, with fixes shipped in OpenSSL 3.4.8, 3.5.9, 3.6.5 and 4.0.3.

RemediationAI

Vendor-released patches are available from the advisory at https://openssl-library.org/news/secadv/20260929.txt and the release at https://github.com/openssl/openssl/releases/tag/openssl-4.0.3: upgrade to OpenSSL 3.4.8, 3.5.9, 3.6.5 or 4.0.3 according to your maintenance branch, noting that 4.0.3 also carries fixes for many other CVEs so a branch upgrade is normally simpler and safer than a narrow backport. If an immediate upgrade is not possible, the most effective compensating control is to eliminate exposure of the vulnerable code path by disabling OpenSSL's QUIC support (build with QUIC turned off, or stop/block the UDP port terminating QUIC and HTTP/3) - the trade-off is loss of HTTP/3/QUIC service for those clients while TLS over TCP continues to work, and it is effective precisely because the vulnerability is unreachable outside the QUIC stack; restricting QUIC also means any application relying solely on QUIC connectivity will be unavailable until the upgrade completes. Supplementary short-term mitigations include rate-limiting or dropping abnormally fragmented or oversized QUIC traffic at the network edge and capping per-connection resource usage, but these only shrink the window for CPU exhaustion and do not remove the quadratic behavior, so they should be treated as temporary. No public exploit code has been identified at time of analysis and CISA's SSVC records exploitation as 'none', so this can be prioritized in a normal patch cycle rather than emergency response, although the breadth of the 4.0.3 security batch argues against indefinite deferral.

Affected VersionsENISA

OpenSSL 3.6.0 <3.6.5
OpenSSL 3.5.0 <3.5.9
OpenSSL 4.0.0 <4.0.3
OpenSSL 3.4.0 <3.4.8

Affected Packages

euvd openssl fix: 3.4.8, 3.5.9, 3.6.5, 4.0.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The root cause is CWE-407, inefficient algorithmic complexity: OpenSSL's native QUIC implementation reassembles fragmented frames before processing them, and the reassembly algorithm degrades quadratically as the number of attacker-controlled fragments grows, so a remote peer can burn disproportionate CPU with modest bandwidth. The exposed surface is OpenSSL's relatively new QUIC code path, which must be explicitly enabled and is not exercised by applications that use the library only for TLS or DTLS, which is why the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) describes a network-reachable, unauthenticated, no-interaction attack whose only outcome is slowing the process rather than crashing it, corrupting data, or leaking information. The release that carries the fix, OpenSSL 4.0.3, is a security-patch release bundling more than a dozen other remediations (DTLS stale-buffer retransmission, X.509 extension cache use-after-free, relative CRLDP memory amplification, additional QUIC DoS variants, EC/SM2 timing side-channels, an SSL_set_SSL_CTX out-of-bounds access, and an AES-SIV EVP_DecryptFinal false-success bug), so operators upgrading for this CVE receive all of those fixes together; NVD references point to commits 32d0ed8afe1b8c3e7ece725b44663da3d7087a09, ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e, eb2becc0a4baea7f3050a247834d0e5c2ebe1773 and f42ae513bbda513b3c121d54834040ee4a0eae1a, and the vendor documentation is at https://openssl-library.org/news/secadv/20260929.txt.

Know when OpenSSL gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI 5.3 MEDIUM

Network-reachable QUIC endpoint, no auth or interaction (AV:N/AC:L/PR:N/UI:N); algorithmic-complexity CPU exhaustion yields partial availability impact only (A:L), no C/I.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.3 MEDIUM

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

3
CVSS changed
Sep 30, 2026 - 22:08 NVD
5.3 (MEDIUM)
CVE Published
Sep 29, 2026 - 13:53 github-releases
MEDIUM 5.3
CVE Published
Sep 29, 2026 - 13:53 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of openssl/openssl. NVD scoring and full description are pending.

Threat Intelligence Overview

EPSS Score
0.3%
Top 76% exploitable
Prevalence
Ubiquitous
OpenSSL is foundational crypto in most servers; QUIC code path narrower
Data Quality
8 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

26
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

More in OpenSSL

View all
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2021-3711 CRITICAL POC
9.8 Aug 24

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
CVE-2014-0195 MEDIUM POC
6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2016-0800 MEDIUM POC
5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
CVE-2015-0204 MEDIUM POC
4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2022-2068 HIGH
7.3 Jun 21

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas
CVE-2015-4000 LOW POC
3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro
CVE-2014-3566 LOW POC
3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM POC
6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

Same weakness CWE-407 – Inefficient Algorithmic Complexity

View all
CVE-2026-54892 HIGH POC
8.7
CVE-2026-90776 HIGH POC
8.7
CVE-2026-59094 HIGH POC
8.7
CVE-2026-13311 HIGH POC
8.7
CVE-2026-54284 HIGH POC
8.7
CVE-2022-45061 HIGH POC
7.5
CVE-2026-71321 HIGH POC
7.5
CVE-2026-56669 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP6-CHOST-BYOS Not-Affected
SLES15-SP6-CHOST-BYOS Not-Affected
SLES15-SP6-CHOST-BYOS-Aliyun Not-Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:74162 ADVISORY https://access.redhat.com/errata/RHSA-2026:74166 ADVISORY https://github.com/openssl/openssl/releases/tag/openssl-4.0.3 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42772 ADVISORY https://seclists.org/oss-sec/2026/q3/1001 ADVISORY https://ubuntu.com/security/notices/USN-8861-1 ADVISORY https://vuldb.com/vuln/411427 REF https://github.com/openssl/openssl/commit/32d0ed8afe1b8c3e7ece725b44663da3d7087a09 REF https://github.com/openssl/openssl/commit/ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e REF https://github.com/openssl/openssl/commit/eb2becc0a4baea7f3050a247834d0e5c2ebe1773 REF https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a REF https://openssl-library.org/news/secadv/20260929.txt

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy