CVE-2026-18798

A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID (destination connection ID) can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service.

This issue can cause memory corruption due to the double free of the QRX object. However, there is currently no evidence it allows remote code execution, limiting the impact of this vulnerability to a denial of service. For these reasons, this flaw has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.