CVE-2026-35191

A flaw was found in OpenSSL. This vulnerability allows a remote attacker to abuse the server to amplify network traffic in a Denial of Service (DoS) attack. When the server is configured without client address validation, incoming datagrams containing multiple QUIC packets cause the server to calculate credit limits incorrectly by adding the total datagram size for each packet. Consequently, the server exceeds standard rate limits and transmits excessive response data to spoofed target addresses.

This issue is rated Low because an OpenSSL QUIC server with address validation disabled can over-count unvalidated amplification credit when a datagram contains multiple QUIC packets, weakening the RFC 9000 3x amplification limit. Impact is limited traffic amplification potential, not direct data compromise. The flaw is confined to the OpenSSL QUIC stack (outside FIPS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If QUIC is not required, disable it in the application or proxy. Prefer leaving QUIC address validation enabled (OpenSSL default). Restrict untrusted UDP/QUIC peers.