Description

Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T15:19:31.820Z",
  "pubdate": "2026-08-13T15:19:31.820Z",
  "executiveSummary": "An unauthenticated Denial of Service (DoS) vulnerability exists in OpenSSL due to the allocation of resources without limits or throttling, designated as CWE-770.\nThe vulnerability impacts OpenSSL QUIC servers (Listener SSL objects) starting from version 3.5 when the QUIC server implementation was introduced.\nThe flaw allows a remote peer capable of transmitting valid QUIC Initial packets faster than the local application accepts connections to cause uncontrolled memory growth for per-channel state storage.\nSuccessful exploitation exhausts available system memory, potentially rendering the QUIC listener unavailable and resulting in a complete Denial of Service.\nThe vulnerability requires no authentication or privileges, relying purely on the network exposure of the QUIC listener and an attack flow that outpaces the application-layer SSL_accept(3ossl) processing rate.",
  "technicalDetails": "The vulnerable component is the inbound QUIC packet handling function within the OpenSSL QUIC server implementation, present since OpenSSL 3.5.\nThe root cause of the vulnerability is the absence of any resource limit or throttling mechanism when processing inbound QUIC Initial packets destined for unknown Connection IDs.\nWhen the server processes a valid QUIC Initial packet with an unknown Connection ID, the handler fails to locate an existing QUIC channel and treats the packet as a new connection request.\nUpon making this determination, the function allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application via SSL_accept(3ossl).\nBecause no bounds are enforced on this queue or the associated memory allocations, a remote attacker can continuously flood the listener with valid QUIC Initial packets.\nIf the local application is unable to call SSL_accept() frequently enough to drain the queue, the memory occupied by these initial channel objects grows without bound.\nThe attack is network-exposed, requiring no prior authentication or elevated privileges, and leverages legitimate protocol behaviors to exhaust server memory resources.\nThe FIPS module is not affected by this vulnerability because the QUIC implementation resides outside the OpenSSL FIPS module boundary."
}