CVE-2026-42772

A flaw was found in OpenSSL. A remote attacker who establishes a QUIC network connection can cause a Denial of Service (DoS) by sending specially sequenced, out-of-order stream frames. Because the stream reassembly mechanism handles non-sequential data fragments inefficiently, processing these frames forces the server to consume excessive CPU resources. Consequently, an attacker can exhaust system processing capacity using minimal network bandwidth.

This issue is rated Moderate because a remote QUIC peer that completes the handshake can force inefficient O(n^2) stream fragment reassembly, creating connection-scoped CPU pressure and possible denial of service with modest attacker bandwidth. There is no confidentiality or integrity impact. The flaw is confined to the OpenSSL QUIC stack (outside FIPS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If QUIC is not required, disable it in the application or reverse proxy. Restrict untrusted QUIC/UDP peers able to complete a handshake.