CVE-2026-54873

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted network packets to a QUIC protocol endpoint. Because the QUIC stack retains memory in packet buffers until the receiving application reads the stream data, an attacker can manipulate data transfers to keep these buffers allocated indefinitely. This behavior leads to excessive memory consumption and can exhaust available system resources.

This issue is rated Moderate because a remote QUIC peer can cause the stack to retain packet-buffer memory longer than necessary while stream data waits for the application, producing attacker-controlled memory pressure. There is no confidentiality or integrity impact. The flaw is confined to the OpenSSL QUIC stack (outside FIPS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If QUIC is not required, disable it in the application or reverse proxy. Restrict untrusted QUIC peers and apply process memory limits where appropriate.