CVE-2026-84784

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) by flooding a connection with connection identifier update requests while withholding acknowledgments. This behavior bypasses connection limits and forces the system to accumulate pending retirement frames, resulting in excessive memory consumption.

This issue is rated Moderate because a remote QUIC peer can force unbounded growth of pending RETIRE_CONNECTION_ID control frames when acknowledgments are withheld, producing memory pressure rather than a reliable full outage. There is no confidentiality or integrity impact. The flaw is confined to the OpenSSL QUIC stack (outside FIPS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If QUIC is not required, disable it in the application or reverse proxy. Restrict untrusted QUIC/UDP peers that can complete or attempt a handshake.