Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection.
Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service.
The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself.
FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade opensslUpgrade openssl-libsUpgrade openssl-perlUpgrade openssl-devel | Oct 11, 2026 | Sep 14, 2026 |
| Alpine Linux | — | Upgrade openssl | Aug 26, 2026 | Aug 25, 2026 |
| Amazon_linux_2023 | — | Upgrade openssl-debuginfoUpgrade openssl-snapsafe-libsUpgrade openssl-develUpgrade openssl-debugsourceUpgrade openssl-fips-provider-latestUpgrade opensslUpgrade openssl-libs-debuginfoUpgrade openssl-fips-provider-latest-debuginfoUpgrade openssl-snapsafe-libs-debuginfoUpgrade openssl-perlUpgrade openssl-libs | Sep 30, 2026 | Aug 25, 2026 |
| Debian | — | Upgrade openssl | Aug 26, 2026 | Aug 26, 2026 |
| Freebsd | — | Upgrade openssl35Upgrade FreeBSDUpgrade openssl34Upgrade opensslUpgrade openssl36Upgrade openssl40 | Aug 26, 2026 | Aug 25, 2026 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Aug 27, 2026 | Aug 25, 2026 |
| Redhat_linux | — | Upgrade openssl-develUpgrade openssl-debugsourceUpgrade openssl-libs-debuginfoUpgrade openssl-libsUpgrade openssl-debuginfoUpgrade openssl-perlUpgrade openssl | Aug 27, 2026 | Aug 25, 2026 |
| Rocky_linux | — | Upgrade openssl-debuginfoUpgrade openssl-libs-debuginfoUpgrade opensslUpgrade openssl-debugsourceUpgrade openssl-perlUpgrade openssl-develUpgrade openssl-libs | Sep 17, 2026 | Sep 15, 2026 |
| Ubuntu | — | Upgrade libssl3t64Upgrade libssl3Upgrade openssl | Aug 26, 2026 | Aug 25, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 21, 2026 | Aug 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub