What is the CVSS score of EUVD-2026-89015?

EUVD-2026-89015 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-89015?

Within 24 hours, inventory all systems using OpenSSL and identify any QUIC-enabled endpoints; if QUIC is not required, disable it to reduce exposure, and if QUIC is required, apply the vendor-released patch immediately. Vendor-released patch: OpenSSL 4.0.3, 3.4.8, 3.5.9, and 3.6.5, so upgrade to the appropriate version for your branch and monitor memory usage on affected services for signs of exhaustion. Within 7 days, complete patching across all production and non-production environments, verify patch installation by checking version strings, and enable rate limiting or connection limits on QUIC endpoints as a temporary mitigation if patching is delayed. Within 30 days, conduct a full audit to confirm no vulnerable versions remain, update software inventory and vulnerability management records, and review QUIC deployment necessity to minimize future exposure.

OpenSSL EUVD-2026-89015

Q: Which versions of OpenSSL are affected by EUVD-2026-89015?

Organizations running OpenSSL's QUIC-enabled services are exposed to a high-severity denial-of-service vulnerability that could cause service outages if exploited.. A patch is available.

| CVE-2026-84784 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-09-29

GHSA-4fx9-95x6-pq4q

Denial Of Service OpenSSL

7.5

CVSS 3.1 · Vendor

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Open QUIC connection to OpenSSL endpoint
Delivery

Flood RETIRE_CONNECTION_ID frames
Exploit

Backlog grows unbounded
Execution

Memory/CPU exhaustion
Impact

Denial of service

Vulnerability Assessment

Weakness	CWE CWE-770 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V2 - Validation and Business Logic Resource allocation limits MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires that the target run a build/deployment using OpenSSL's QUIC implementation (the RETIRE_CONNECTION_ID handling in the QUIC stack) and expose a reachable QUIC endpoint; the affected library versions are OpenSSL 3.4.0<3.4.8, 3.5.0<3.5.9, 3.6.0<3.6.5, and 4.0.0<4.0.3. No authentication, no user interaction, and no non-default option beyond enabling QUIC are needed (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is adoption: OpenSSL's QUIC support is comparatively new and not enabled in many traditional TLS-only deployments, so endpoints that terminate only TLS/DTLS over TCP are not exposed to this specific frame-flood path.
Impact	This is a network-reachable, unauthenticated availability-only flaw (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H, vendor score 7.5) in OpenSSL's QUIC stack: an unbounded RETIRE_CONNECTION_ID backlog (CWE-770 resource exhaustion). All signals point to a genuine but bounded-severity DoS rather than a critical priority. SSVC reinforces this: Exploitation='none' (no observed activity), Technical Impact='partial' (single-service DoS, not total compromise), but Automatable='yes' (the trigger is a repeatable protocol message flood, so it can be scripted at scale). EPSS is not provided and the CVE is not on CISA KEV, so there is no evidence of active exploitation. No confidentiality or integrity impact exists - the worst case is memory/CPU exhaustion of a QUIC endpoint. The most important scoping caveat: this affects ONLY the OpenSSL QUIC implementation, which is a relatively new and not-yet-widely-adopted code path, so despite OpenSSL's ubiquity the actual exposed attack surface is far narrower than the raw product prevalence suggests. Net: a real, easily-automatable DoS worth patching in the normal cycle, not an emergency.
Exploit ScenarioDerived	A remote unauthenticated attacker establishes a QUIC connection to an OpenSSL-based server (or client) and repeatedly sends RETIRE_CONNECTION_ID frames faster than they are processed, causing an unbounded backlog that exhausts memory and degrades or crashes the endpoint. No authentication or user interaction is required, and because the trigger is a simple repeatable protocol message the attack is trivially scriptable (SSVC Automatable=yes). No public exploit code is identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Denial of service in OpenSSL's QUIC stack affects OpenSSL 3.4.0 before 3.4.8, 3.5.0 before 3.5.9, 3.6.0 before 3.6.5, and 4.0.0 before 4.0.3, where an unbounded backlog of RETIRE_CONNECTION_ID frames lets remote unauthenticated attackers exhaust memory by flooding a reachable QUIC endpoint. The flaw is an allocation-without-limits issue (CWE-770) rated CVSS 7.5 (availability-only, AV:N/AC:L/PR:N/UI:N) and addressed in the OpenSSL 4.0.3, 3.4.8, 3.5.9, and 3.6.5 patch releases. No public exploit identified at time of analysis; the attack is automatable, but exposure is limited to deployments that enable OpenSSL's relatively new QUIC support.

RemediationAI

Vendor-released patches are available: upgrade to OpenSSL 4.0.3, 3.4.8, 3.5.9, or 3.6.5 depending on the maintained branch; the fixes correspond to the upstream commits listed in the references and are described in the vendor advisory at https://openssl-library.org/news/secadv/20260929.txt. Because the flaw is reachable only through OpenSSL's QUIC implementation, deployments that do not require QUIC can eliminate exposure by building or configuring without QUIC support, though this disables HTTP/3 and any QUIC-based transport and may affect applications relying on those protocols. If QUIC must remain enabled before patching, reduce the attack surface by restricting or rate-limiting UDP QUIC traffic (typically UDP/443) at the network edge, accepting possible disruption to legitimate HTTP/3 clients, and monitor for memory exhaustion on QUIC-terminating endpoints. Do not rely on these mitigations as substitutes for the available vendor patches.

Affected VersionsENISA

OpenSSL 3.4.0 <3.4.8

OpenSSL 4.0.0 <4.0.3

OpenSSL 3.5.0 <3.5.9

OpenSSL 3.6.0 <3.6.5

Affected Packages

euvd openssl fix: 3.4.8, 3.5.9, 3.6.5, 4.0.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in OpenSSL's QUIC stack, specifically in handling of RETIRE_CONNECTION_ID frames. QUIC (RFC 9000) uses connection IDs to maintain associations across address changes, and endpoints signal retirement of unused connection IDs via RETIRE_CONNECTION_ID frames. OpenSSL failed to limit the backlog of these frames, so a remote peer can send an unbounded stream of such frames, causing cumulative resource allocation without throttling (CWE-770). This is an availability-only issue with no confidentiality or integrity impact, as reflected in the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The affected library versions are OpenSSL 3.4.0 before 3.4.8, 3.5.0 before 3.5.9, 3.6.0 before 3.6.5, and 4.0.0 before 4.0.3; fixes are present in the referenced upstream commits and the 4.0.3 release notes. Exploitation requires a deployment that enables OpenSSL's QUIC implementation and exposes a reachable QUIC endpoint; no authentication, user interaction, or non-default option beyond QUIC enablement is needed.

Know when OpenSSL gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Remote unauthenticated attacker floods QUIC frames with no interaction (AV:N/AC:L/PR:N/UI:N); pure resource-exhaustion DoS gives A:H with no C/I impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Red Hat 5.3 MEDIUM

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Sep 29, 2026 - 17:22 NVD

7.5 (HIGH)

CVE Published

Sep 29, 2026 - 13:53 github-releases

UNKNOWN (no severity yet)

CVE Published

Sep 29, 2026 - 13:53 github-releases

HIGH 7.5

Description PRE-NVD

Disclosed via GitHub release of openssl/openssl. NVD scoring and full description are pending.

Articles & Coverage 2

News 4 New OpenSSL Vulnerabilities - 4 High Severity, No POC Available Sep 30, 2026 News 4 New OpenSSL Vulnerabilities - 4 High Severity, No POC Available Sep 29, 2026

Executive ViewAI

Why It Matters

Organizations running OpenSSL's QUIC-enabled services are exposed to a high-severity denial-of-service vulnerability that could cause service outages if exploited. The flaw allows remote, unauthenticated attackers to exhaust server memory, potentially disrupting availability for customers and internal users. As no public exploit identified at time of analysis, leadership should ensure affected systems are patched promptly because the attack is automatable and affects network-facing components.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.4%

Top 68% exploitable

Prevalence

Ubiquitous

OpenSSL is a core crypto/TLS library across nearly all server environments

Data Quality

8 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in OpenSSL

View all

CVE-2014-0160 HIGH Act Now POC

7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

CVE-2021-3711 CRITICAL Act Now POC

9.8 Aug 24

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri

CVE-2014-0195 MEDIUM This Month POC

6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2016-0800 MEDIUM This Month POC

5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se

CVE-2015-0204 MEDIUM This Month POC

4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2022-2068 HIGH Act Now

7.3 Jun 21

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas

CVE-2015-4000 LOW Monitor POC

3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro

CVE-2014-3566 LOW Monitor POC

3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM This Month POC

6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH Act Now

7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all

CVE-2017-8779 HIGH POC

7.5

CVE-2025-53521 CRITICAL POC

9.3

CVE-2024-28182 MEDIUM

5.3

CVE-2023-2650 MEDIUM

6.5

CVE-2017-5850 HIGH POC

7.5

CVE-2025-26682 HIGH

7.5

CVE-2022-32206 MEDIUM POC

6.5

CVE-2023-24998 HIGH

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
Container bci/bci-sle15-kernel-module-devel:15.7-61.25 Container bci/openjdk-devel:17.0.20.1-21.71 Container bci/openjdk-devel:21.0.12.1-25.71 Container bci/openjdk-devel:25.0.4.1-9.72 Container bci/openjdk:17.0.20.1-20.61 Container bci/openjdk:21.0.12.1-24.60 Container bci/openjdk:25.0.4.1-9.60 Container bci/python:3.13.15-88.58 Container bci/python:3.6.15-84.56 Container suse/sle15:15.7-5.23.43	Affected
Container private-registry/1.2/harbor-core:1.2.1-1.115 Container private-registry/1.2/harbor-exporter:1.2.1-1.115 Container private-registry/1.2/harbor-jobservice:1.2.1-1.113 Container private-registry/1.2/harbor-registry:1.2.1-1.115 Container private-registry/1.2/harbor-registryctl:1.2.1-1.115 Container private-registry/1.2/harbor-trivy-adapter:1.2.1-1.124 Container private-registry/harbor-core:latest Container private-registry/harbor-exporter:latest Container private-registry/harbor-jobservice:latest Container private-registry/harbor-registry:2.8.3-1.85 Container private-registry/harbor-registryctl:latest Container private-registry/harbor-trivy-adapter:0.35.1-1.87 Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.177 Container suse/kiosk/tigervnc-x11vnc:1.14-63.43 Container suse/mariadb:11.8.8-79.42 Image SLES15-SP7-Azure-Basic Image pr_15_7_1_0	Affected
Container private-registry/1.2/harbor-portal:1.2.1-1.124 Container private-registry/harbor-portal:latest Container suse/kea:2.6-80.9 Container suse/kiosk/firefox-esr:153.3-75.45 Container suse/kiosk/pulseaudio:17.0-73.42 Container suse/kiosk/xorg-client:21-81.7 Container suse/kiosk/xorg:21.1-83.42 Container suse/mariadb-client:11.8.8-72.32 Container suse/postgres:16.15-93.41 Container suse/postgres:16.15-contrib-93.41 Container suse/postgres:17.11-83.40 Container suse/postgres:17.11-contrib-83.40 Container suse/postgres:18.6-73.40 Container suse/rmt-server:3.1-72.2 Container suse/samba-client:4.21-75.34 Container suse/samba-server:4.21-76.36 Container suse/samba-toolbox:4.21-76.34 Container third-party/amd/amdgpu-driver:sles-15.7-30.20.1 Container third-party/amd/amdgpu-driver:sles-15.7-30.30.4 Container third-party/amd/amdgpu-driver:sles-15.7-31.10 Container third-party/amd/amdgpu-driver:sles-15.7-31.20 Container third-party/amd/amdgpu-driver:sles-15.7-31.30 Container third-party/amd/amdgpu-driver:sles-15.7-31.40.1 Container third-party/amd/amdgpu-driver:sles-15.7-31.50 Container third-party/nvidia/driver:550-sles15.7 Container third-party/nvidia/driver:570-sles15.7 Container third-party/nvidia/driver:575-sles15.7 Container third-party/nvidia/driver:580-sles15.7 Container third-party/nvidia/driver:590-sles15.7 Container third-party/nvidia/driver:595-sles15.7 Container third-party/nvidia/driver:610-sles15.7 Container third-party/nvidia/driver:615-sles15.7	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud	Not-Affected

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:74162 ADVISORY https://access.redhat.com/errata/RHSA-2026:74166 ADVISORY https://github.com/openssl/openssl/releases/tag/openssl-4.0.3 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-84784 ADVISORY https://seclists.org/oss-sec/2026/q3/1001 ADVISORY https://ubuntu.com/security/notices/USN-8847-1 ADVISORY https://vuldb.com/vuln/411437 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4414/ REF https://github.com/openssl/openssl/commit/4685c914b0d410b1034f40b547c95bc95e7a380a REF https://github.com/openssl/openssl/commit/9a30fe0fba195c14e5b87bf93c0d0fdb70373806 REF https://github.com/openssl/openssl/commit/dba3c48d653c64fcbc9070a17a0ee2b3e2f3af1f REF https://github.com/openssl/openssl/commit/e9e5155833fa968bee50024bf9ca3a185ab599fe REF https://openssl-library.org/news/secadv/20260929.txt

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back