CVE-2026-42772

Analyzed Analyzed - Analysis Complete

QUIC Stream Reassembly CPU Exhaustion in OpenSSL

Publication date: 2026-09-29

Last updated on: 2026-10-08

Assigner: OpenSSL Software Foundation

Description

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407: Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations, consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-42772

EUVD

EUVD-2026-89003

Affected Vendors & Products

Vendor	Product	Version / Range
openssl	openssl	From 3.4.0 (inc) to 3.4.8 (exc)
openssl	openssl	From 3.5.0 (inc) to 3.5.9 (exc)
openssl	openssl	From 3.6.0 (inc) to 3.6.5 (exc)
openssl	openssl	From 4.0.0 (inc) to 4.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability is in OpenSSL's QUIC implementation where the stream reassembly algorithm becomes inefficient when packets arrive out of order. Instead of processing data linearly, it performs O(n^2) operations, consuming excessive CPU time. The issue stems from using a doubly-linked list that requires linear searches for non-sequential fragments, allowing attackers to force high CPU usage with low bandwidth.

Detection Guidance

This vulnerability is specific to OpenSSL's QUIC implementation and may not have direct detection commands. Monitor for high CPU usage in QUIC processes or unusual memory consumption patterns in OpenSSL services. Check OpenSSL version against patched releases.

Impact Analysis

A remote attacker can exploit this to cause a Denial of Service by sending compliant QUIC stream frames that force the server to use excessive CPU resources. This could degrade server performance, disrupt services, or crash systems handling QUIC traffic.

Compliance Impact

This vulnerability primarily causes excessive CPU usage and potential Denial of Service through inefficient stream reassembly in QUIC, rather than direct data exposure or privacy violations. It does not inherently violate GDPR or HIPAA compliance requirements, but could indirectly impact availability of services handling personal or health data.

Mitigation Strategies

Update OpenSSL to the latest patched version that includes the new QUIC stream reassembly mechanism. Disable QUIC support if not required. Monitor network traffic for abnormal QUIC stream patterns that may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-42772. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70