Issue summary: QUIC process may keep memory for QUIC packet
buffer for much longer period than necessary.
Impact summary: Remote peer can exploit this vulnerability
by sending maliciously crafted packets, making the local
QUIC stack to keep the memory for packet buffers allocated.
The time for which the memory remains allocated is entirely
under the control of the potentially malicious remote peer.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Description: To save copy operation from the packet buffer to the
stream reassemble buffer the QUIC stack leaves the stream data
on the packet buffer waiting to be copied to a buffer provided
by the local receiving application. The QUIC stack releases
a reference to the packet buffer only after the data are copied
to the application buffer. This design is more efficient for
legitimate data transfers but enables an attacker to allocate a lot
more memory than actually required by the data kept in the receiving
stream buffer.
To mitigate the vulnerability, the QUIC stack now calculates
and monitors memory overhead for every stream. The memory overhead
for a single stream frame is calculated as a difference between the
size of the whole packet that carries the stream frame and the size
of the stream frame itself. The memory overhead for a single stream
frame is added to the total (cumulative) memory overhead QUIC stack
keeps for each stream. Once the cumulative memory overhead exceeds
64kB, the QUIC stack moves the stream frame data from the packet
buffer to the stream buffer, starting with the next packet received.
FIPS impact: no
The FIPS module is not affected as the QUIC implementation is outside of
the OpenSSL FIPS module boundary.
References
Configurations
Configuration 1 (hide)
|
History
08 Oct 2026, 01:19
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Openssl openssl
Openssl |
|
| CPE | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* | |
| References | () https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23 - Patch | |
| References | () https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53 - Patch | |
| References | () https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb - Patch | |
| References | () https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2 - Patch | |
| References | () https://openssl-library.org/news/secadv/20260929.txt - Vendor Advisory |
30 Sep 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
29 Sep 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-29 16:17
Updated : 2026-10-08 01:19
NVD link : CVE-2026-54873
Mitre link : CVE-2026-54873
CVE.ORG link : CVE-2026-54873
JSON object : View
Products Affected
openssl
- openssl
CWE
CWE-770
Allocation of Resources Without Limits or Throttling