CVE-2026-75804

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) due to missing connection-level flow control enforcement in the QUIC protocol implementation. By opening multiple streams that respect individual stream limits while preventing data consumption, the attacker can force the system to buffer far more data than permitted by the connection limit. This excessive memory allocation can exhaust available system resources and degrade or terminate the service.

A denial of service vulnerability of moderate severity was found in the OpenSSL QUIC implementation. The QUIC stack enforces the per-stream flow control limit but does not enforce the connection-level flow control limit. A remote, unauthenticated peer can exploit this by opening multiple streams that each stay within the per-stream limit while sending no zero-offset byte (which prevents the stack from consuming the data), forcing the local QUIC stack to buffer far more data than the connection limit permits. With default settings (a maximum of 200 streams and a 512 KiB per-stream window), a malicious peer can drive the stack to allocate roughly 100 MB of heap per connection instead of the default 768 KiB connection window, which can exhaust memory and degrade or terminate the affected service. There is no impact on confidentiality or integrity. Red Hat rates this issue as Moderate severity (CVSS 3.1 score 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), whereas upstream OpenSSL classified it as Low severity.

Only OpenSSL versions that contain the QUIC stack are affected. Red Hat Enterprise Linux streams shipping OpenSSL 1.x (including the openssl 1.0.x/1.1.1, compat-openssl10, compat-openssl11, and mingw-openssl 1.x components on RHEL 6, 7, and 8 streams) are not affected because the vulnerable QUIC code is not present in those versions. Affected Red Hat products that ship an OpenSSL version with the QUIC stack are being addressed through their respective update streams; for a number of these products the fix is deferred to a future scheduled update given the denial-of-service-only nature of this flaw. The residual risk of deferral is limited to remote memory-exhaustion denial of service against applications that use the OpenSSL QUIC API. The OpenSSL FIPS module is not affected because the QUIC implementation is outside the FIPS module boundary.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.