CVE-2026-42764

A flaw was found in the OpenSSL QUIC (Quick UDP Internet Connections) server. A remote attacker could send a specially crafted QUIC initial packet with an invalid token. If the server's address validation is explicitly disabled, this could lead to a NULL pointer dereference, causing the server process to terminate abnormally and resulting in a Denial of Service (DoS).

This is a Moderate severity issue. A NULL pointer dereference can occur in the OpenSSL QUIC server when processing initial packets with invalid tokens, leading to a denial of service. This vulnerability is only exploitable if the client address validation is explicitly disabled using the SSL_LISTENER_FLAG_NO_VALIDATE flag, which is not the default configuration for OpenSSL QUIC servers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that the OpenSSL QUIC server has client address validation enabled. This is the default configuration. If the SSL_LISTENER_FLAG_NO_VALIDATE flag is being used with the SSL_new_listener() call, it should be removed to prevent the vulnerability from being exploitable.