CVE-2026-63075

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory exhaustion, eventually resulting in a denial of service.

To exploit this issue, an attacker needs to complete a QUIC handshake and repeatedly send ack-eliciting packets while not acknowledging ACK-only responses. This causes the QUIC implementation to retain metadata for ACK-only responses for the lifetime of a connection, leading to excessive memory consumption, eventually resulting in a denial of service with no other security impact. For these reasons, this vulnerability has been rated with a low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.