CVE-2026-14456

A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption can result in a Denial of Service (DoS) condition, making the QUIC listener unavailable.

Red Hat Enterprise Linux 9.8+, 10.2+, Red Hat Hardened Images, RHIVOS 2, and OpenShift 4.22 ship OpenSSL 3.5.x which includes the QUIC server implementation affected by this flaw. Earlier RHEL versions ship OpenSSL 3.2.x or below, which do not include the QUIC server feature and are not affected. The FIPS module is not affected as the QUIC implementation is outside the OpenSSL FIPS module boundary. Applications must explicitly enable the QUIC server listener to be vulnerable; simply having OpenSSL 3.5 installed does not expose the flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Option 1: Rate-limit or Firewall Inbound QUIC (UDP 443) [Goal: Slow or block QUIC Initial packets before they reach the vulnerable listener.]

A. Confirm QUIC Exposure - Check if any service is listening on UDP 443:

$ ss -ulnp | grep ':443'
# or
$ sudo lsof -iUDP:443 -n -P

Note: If no service is listening on UDP 443, this CVE does not apply (TCP 443 is unaffected).

B. Restrict Access to UDP 443 ( Default-deny UDP 443 and allow only trusted networks:)

$ sudo firewall-cmd --permanent --remove-service=quic 2>/dev/null
$ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="443" protocol="udp" accept'
$ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="443" protocol="udp" drop'
$ sudo firewall-cmd --reload

C. Verify - Confirm the restriction by testing from an external host (the connection should fail or be throttled):

$ nc -u -v YOUR_HOST 443

Option 2: Disable QUIC Server

If QUIC/HTTP3 is not required, remove the vulnerable code path entirely and use TLS/TCP instead.

Recommended Mitigation Priority Priority : Action 1.Confirm UDP 443 QUIC listener exists and OpenSSL version is in affected range 2.Block or rate-limit UDP 443 at firewall/edge (immediate) 3.Disable QUIC/HTTP3 on the service if not needed 4.Upgrade OpenSSL to fixed release when available 5.Application owners: set SSL_VALUE_QUIC_MAX_PENDING_CONNS if default 256 is too high