What is the CVSS score of EUVD-2026-89009?

EUVD-2026-89009 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.4%.

Is there a patch available for EUVD-2026-89009?

Yes, a patch is available for EUVD-2026-89009. Update the affected software to the latest version immediately.

OpenSSL EUVD-2026-89009

| CVE-2026-75804 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-09-29

GHSA-gjmh-wx93-r4pw

Denial Of Service OpenSSL

5.3

CVSS 3.1 · Vendor

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Establish QUIC connection to OpenSSL peer
Delivery

Open one or more QUIC streams
Exploit

Send data exceeding connection flow-control credit
Execution

Bypass unenforced connection-level limit
Impact

Exhaust buffering resources causing DoS

Vulnerability Assessment

Weakness	CWE CWE-770 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V2 - Validation and Business Logic Resource allocation limits MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the target application to use OpenSSL's QUIC implementation (present in the affected 3.4-4.0 branches) and to accept QUIC connections/streams from the attacker; the attacker acts as a connected QUIC peer opening streams and overrunning connection-level flow-control credit. It is remote and needs no authentication or user interaction (PR:N/UI:N), but exposure is materially limited to deployments that actually enable and use the OpenSSL QUIC stack - the vast majority of OpenSSL usage (classic TLS/record layer) is unaffected. Impact is limited to availability degradation, not code execution or data disclosure.
Impact	This is a legitimately modest-risk issue despite affecting an ubiquitous library. The vendor CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3, Medium) is internally consistent with the CWE-770 (uncontrolled resource consumption) classification and the description: QUIC connection-level flow control was not enforced for individual streams, so a remote peer can exceed intended data limits and drive resource/memory consumption - a bounded availability impact only (C:N/I:N/A:L), no code execution or data exposure. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis'; this is not the High-severity flaw of the 4.0.3 batch (that is the DTLS OOB read CVE-2026-84782). No SSVC decision data was supplied. The one caveat that constrains real-world risk far below the raw score: this bug only affects the relatively new OpenSSL QUIC implementation, which a comparatively small fraction of OpenSSL deployments actually use, so the ubiquity of OpenSSL does not translate into ubiquitous exposure for this specific defect.
Exploit ScenarioDerived	An attacker establishes a QUIC connection to an application built on OpenSSL's QUIC stack and opens streams, then transmits more stream data than the negotiated connection-level flow-control credit should permit. Because the connection-level limit is not enforced across streams, the peer forces excess buffering and resource consumption, degrading or denying service. No public proof-of-concept was identified at the time of analysis.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Improper enforcement of QUIC connection-level flow control in OpenSSL allows a remote, unauthenticated peer that has established a QUIC connection to open streams while bypassing the connection-wide credit accounting that is supposed to cap in-flight data, resulting in resource exhaustion and availability degradation (CVSS 5.3, CWE-770). The issue affects the OpenSSL QUIC stack in the 3.4.0 through 4.0.2, 3.5.0 through 3.5.8, and 3.6.0 through 3.6.4 lines, and is fixed in the vendor's 4.0.3 security release, which also ships the fixes for the companion 3.4.8, 3.5.9 and 3.6.5 branches; exploitation is limited to deployments that actually enable and terminate QUIC connections, so classic TLS/record-layer usage of the library is unaffected. There is no public exploit identified at time of analysis (no CISA KEV listing and no observed POC), and the assessed impact is confined to denial of service rather than code execution or data disclosure.

RemediationAI

Vendor-released patch: upgrade to OpenSSL 4.0.3 (from the 4.0.x line), or 3.6.5, 3.5.9, or 3.4.8 on the older branches respectively - these are the versions that incorporate the QUIC connection-level flow-control fix, and the 4.0.3 release notes and https://openssl-library.org/news/secadv/20260929.txt confirm it. Because 4.0.3 bundles a large number of other QUIC, DTLS, X.509 and side-channel fixes, upgrading within your existing branch is preferable to crossing major versions, and the specific upstream commits (2e8f5466b3fb7b05ff5f58aa6cac9285163654e, 4533ee8a5686c953ed3b644738ac4bdf20806538, 64d3102fb5b54311e92517f26ba00169d719e74a, f9eaecf5bdd6692da052bc65b0332af2a938ac03) can be backported if you maintain a pinned fork. If immediate upgrade is not possible, the effective compensating control is to stop serving QUIC: set SSL_CTX options or build configuration to disable QUIC/HTTP-3 listeners and fall back to TLS over TCP, accepting the loss of HTTP/3 performance benefits, or front the QUIC endpoint with a load balancer/proxy that enforces its own connection-level limits and stream-count caps (for example, bounding concurrent streams, idle timeouts, and per-connection buffer headroom) so an abusive peer is throttled or dropped before it can exhaust the application's memory - this mitigates the availability impact but does not correct the underlying library behavior. Monitor process memory and connection counts for QUIC endpoints as a detection measure, since the exploit signature is abnormal memory retention tied to a single peer's stream activity.

Affected VersionsENISA

OpenSSL 3.6.0 <3.6.5

OpenSSL 3.5.0 <3.5.9

OpenSSL 3.4.0 <3.4.8

OpenSSL 4.0.0 <4.0.3

Affected Packages

euvd openssl fix: 3.4.8, 3.5.9, 3.6.5, 4.0.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

QUIC is the UDP-based transport underlying HTTP/3 and it implements two layers of flow control: per-stream flow control and a connection-level limit that aggregates the credit consumed by all streams, preventing a peer from forcing a receiver to buffer unbounded data simply by opening many streams. In the affected OpenSSL QUIC implementation the connection-level accounting was not enforced for streams, so a connected peer could advance streams beyond the connection's advertised aggregate limit, causing the receiving endpoint to allocate and hold more data than the configured bound permits - the resource-management failure class described by CWE-770 (Allocation of Resources Without Limits or Throttling). The OpenSSL security advisory and the 4.0.3 release notes describe this as “QUIC connection-level flow control was not enforced for streams,” and the associated upstream commits listed in NVD (2e8f5466, 4533ee8a, 64d3102f, f9eaecf5) are the minimal fix references. Because the defect is confined to the QUIC transport code path, it is distinct from the other issues bundled in the same release - the DTLS retransmission handling bug, the X.509 extension cache use-after-free, relative CRLDP memory amplification, QUIC amplification-credit and fragment-reassembly problems, and the various constant-time/side-channel fixes. The advisory is published under ENISA EUVD-2026-89009 and openssl-library.org/news/secadv/20260929.txt.

Know when OpenSSL gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI 5.3 MEDIUM

Remote QUIC peer with no auth or interaction (AV:N/AC:L/PR:N/UI:N); unenforced flow control yields bounded resource-consumption DoS only, so C:N/I:N/A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE MEDIUM

Red Hat 7.5 HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

CVE Published

Sep 29, 2026 - 13:53 github-releases

MEDIUM 5.3

CVE Published

Sep 29, 2026 - 13:53 github-releases

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of openssl/openssl. NVD scoring and full description are pending.

Threat Intelligence Overview

EPSS Score

0.4%

Top 74% exploitable

Prevalence

Ubiquitous

OpenSSL is a foundational crypto/TLS library across nearly all environments

Data Quality

8 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in OpenSSL

View all

CVE-2014-0160 HIGH Act Now POC

7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

CVE-2021-3711 CRITICAL Act Now POC

9.8 Aug 24

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri

CVE-2014-0195 MEDIUM This Month POC

6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2016-0800 MEDIUM This Month POC

5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se

CVE-2015-0204 MEDIUM This Month POC

4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2022-2068 HIGH Act Now

7.3 Jun 21

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas

CVE-2015-4000 LOW Monitor POC

3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro

CVE-2014-3566 LOW Monitor POC

3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM This Month POC

6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH Act Now

7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all

CVE-2017-8779 HIGH POC

7.5

CVE-2025-53521 CRITICAL POC

9.3

CVE-2024-28182 MEDIUM

5.3

CVE-2023-2650 MEDIUM

6.5

CVE-2017-5850 HIGH POC

7.5

CVE-2025-26682 HIGH

7.5

CVE-2022-32206 MEDIUM POC

6.5

CVE-2023-24998 HIGH

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
Container bci/bci-sle15-kernel-module-devel:15.7-61.25 Container bci/openjdk-devel:17.0.20.1-21.71 Container bci/openjdk-devel:21.0.12.1-25.71 Container bci/openjdk-devel:25.0.4.1-9.72 Container bci/openjdk:17.0.20.1-20.61 Container bci/openjdk:21.0.12.1-24.60 Container bci/openjdk:25.0.4.1-9.60 Container bci/python:3.13.15-88.58 Container bci/python:3.6.15-84.56 Container suse/sle15:15.7-5.23.43	Affected
Container private-registry/1.2/harbor-core:1.2.1-1.115 Container private-registry/1.2/harbor-exporter:1.2.1-1.115 Container private-registry/1.2/harbor-jobservice:1.2.1-1.113 Container private-registry/1.2/harbor-registry:1.2.1-1.115 Container private-registry/1.2/harbor-registryctl:1.2.1-1.115 Container private-registry/1.2/harbor-trivy-adapter:1.2.1-1.124 Container private-registry/harbor-core:latest Container private-registry/harbor-exporter:latest Container private-registry/harbor-jobservice:latest Container private-registry/harbor-registry:2.8.3-1.85 Container private-registry/harbor-registryctl:latest Container private-registry/harbor-trivy-adapter:0.35.1-1.87 Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.177 Container suse/kiosk/tigervnc-x11vnc:1.14-63.43 Container suse/mariadb:11.8.8-79.42 Image pr_15_7_1_0	Affected
Container private-registry/1.2/harbor-portal:1.2.1-1.124 Container private-registry/harbor-portal:latest Container suse/kea:2.6-80.9 Container suse/kiosk/firefox-esr:153.3-75.45 Container suse/kiosk/pulseaudio:17.0-73.42 Container suse/kiosk/xorg-client:21-81.7 Container suse/kiosk/xorg:21.1-83.42 Container suse/mariadb-client:11.8.8-72.32 Container suse/postgres:16.15-93.41 Container suse/postgres:16.15-contrib-93.41 Container suse/postgres:17.11-83.40 Container suse/postgres:17.11-contrib-83.40 Container suse/postgres:18.6-73.40 Container suse/rmt-server:3.1-72.2 Container suse/samba-client:4.21-75.34 Container suse/samba-server:4.21-76.36 Container suse/samba-toolbox:4.21-76.34 Container third-party/amd/amdgpu-driver:sles-15.7-30.20.1 Container third-party/amd/amdgpu-driver:sles-15.7-30.30.4 Container third-party/amd/amdgpu-driver:sles-15.7-31.10 Container third-party/amd/amdgpu-driver:sles-15.7-31.20 Container third-party/amd/amdgpu-driver:sles-15.7-31.30 Container third-party/amd/amdgpu-driver:sles-15.7-31.40.1 Container third-party/amd/amdgpu-driver:sles-15.7-31.50 Container third-party/nvidia/driver:550-sles15.7 Container third-party/nvidia/driver:570-sles15.7 Container third-party/nvidia/driver:575-sles15.7 Container third-party/nvidia/driver:580-sles15.7 Container third-party/nvidia/driver:590-sles15.7 Container third-party/nvidia/driver:595-sles15.7 Container third-party/nvidia/driver:610-sles15.7 Container third-party/nvidia/driver:615-sles15.7	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud	Not-Affected

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:74162 ADVISORY https://access.redhat.com/errata/RHSA-2026:74166 ADVISORY https://github.com/openssl/openssl/releases/tag/openssl-4.0.3 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-75804 ADVISORY https://seclists.org/oss-sec/2026/q3/1001 ADVISORY https://ubuntu.com/security/notices/USN-8847-1 ADVISORY https://vuldb.com/vuln/411435 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4414/ REF https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e REF https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538 REF https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a REF https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03 REF https://openssl-library.org/news/secadv/20260929.txt

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back