EUVD-2026-65485
GHSA-cj75-r57j-r5v8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable QUIC endpoint, handshake completion is the only prerequisite (PR:N), no confidentiality or integrity impact - pure availability DoS consistent with description.
Primary rating from Vendor (openssl).
CVSS VectorVendor: openssl
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
6DescriptionCVE.org
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection.
Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service.
The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself.
FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.
Articles & Coverage 1
AnalysisAI
Memory exhaustion in OpenSSL's QUIC stack allows any remote peer that completes a QUIC handshake to cause unbounded connection-scoped memory growth by sending repeated PING frames while withholding acknowledgments for ack-eliciting packets. Affected versions span OpenSSL 3.4.0 through early 4.0.x; TLS-only deployments and the FIPS module are unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be running OpenSSL 3.4.0-3.4.6, 3.5.0-3.5.7, 3.6.0-3.6.3, or 4.0.0-4.0.1 with the QUIC stack actively in use - TLS-only deployments are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 High vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately characterizes a network-reachable, zero-authentication DoS with no confidentiality or integrity impact; these metrics align with the description's post-handshake trigger requiring no special privileges. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker directs a script to open many concurrent QUIC connections to an OpenSSL-based server (e.g., a reverse proxy or application server with QUIC enabled), completing the handshake on each, then continuously transmitting PING frames to force ACK-only responses while deliberately withholding its own acknowledgments. Over time, each connection accumulates unreleased ACK-only packet metadata in the server's QUIC ACK manager, progressively consuming heap memory until the server process is terminated by the OS OOM killer or becomes unresponsive. … |
| Remediation | Upgrade to a fixed release as confirmed by vendor advisory (https://openssl-library.org/news/secadv/20260825.txt): OpenSSL 3.4.7, 3.5.8, 3.6.4, or 4.0.2 depending on the active release branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all OpenSSL 3.4.0-4.0.x installations with QUIC enabled and categorize by business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today