CVE-2026-63075
Received Received - Intake

Memory Exhaustion in OpenSSL QUIC Implementation

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: OpenSSL Software Foundation

Description
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-63075
EUVD
EUVD-2026-65485

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssl openssl to 2026-63075 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in OpenSSL's QUIC implementation allows a remote peer to cause memory exhaustion by repeatedly sending ack-eliciting packets without acknowledging ACK-only responses. The QUIC stack stores metadata for ACK-only packets indefinitely, leading to unbounded memory growth during sustained traffic or many concurrent connections.

Detection Guidance

This vulnerability is specific to OpenSSL's QUIC implementation and may not have direct detection commands. Monitor memory usage and QUIC connection counts for unusual growth. Check OpenSSL logs for QUIC-related errors or warnings.

Impact Analysis

An attacker could exploit this to crash your system by consuming all available memory, causing a denial of service. This is especially risky if your system handles many QUIC connections or sustained traffic, as memory usage grows without limit.

Compliance Impact

This vulnerability primarily causes a denial-of-service risk through memory exhaustion in OpenSSL's QUIC implementation. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than memory management in QUIC protocol handling.

Mitigation Strategies

Update OpenSSL to the latest version that includes the fix for this issue. If QUIC is not required, disable QUIC support in your OpenSSL configuration. Monitor system memory and QUIC connections for signs of exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63075. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart