Database/Kernel, userspace & hypervisor
OpenSSL: QUIC listener queues unlimited pending connections, exhausting server memory
Impact
A remote peer that sends valid QUIC Initial packets with unknown destination connection IDs faster than the application calls SSL_accept() makes the listener allocate per-channel state without bound, until the process runs out of memory. Any service on the fleet that terminates QUIC/HTTP3 with OpenSSL 3.5 or later is exposed - internal gateways and object-store frontends included. The blast radius is the process, not the node, but a control-plane or storage frontend going down takes scheduling or data access with it. No confidentiality or integrity impact.
Who can reach it
Anyone who can reach the QUIC listener's UDP port. No authentication required - the packets are pre-handshake.
What to do
Patch OpenSSL per the 2026-08-13 advisory and restart every daemon linked against it; the fix caps pending connections at 256, and applications can retune with SSL_set_value_uint(). Only OpenSSL 3.5 and later are affected, since that is when the QUIC server was added - older branches need nothing. The FIPS module is outside the affected boundary. Finding the linked daemons is usually the expensive part; a full node reboot is a blunt but reliable substitute.
References
Related entries
- OpenSSL: raw-public-key endpoints with no certificate abort on a peer-sent signature_algorithms_cert extensionCVE-2026-14457 · OpenSSL TLS endpoint (RFC 7250 raw public keys, private key configured without a certificate)High
- OpenSSL QUIC: malformed INITIAL packet double-frees the record-layer object and kills the server processCVE-2026-18798 · OpenSSL QUIC server (port_default_packet_handler / port_bind_channel QRX object)High
- Linux kernel (drivers/nvme/target): Ordinary client I/O to an nvmet block-device namespace can hit a completion raceCVE-2026-23148 · Linux kernel (drivers/nvme/target)High
- Linux kernel (net/tls): The queue that pins encrypted input buffers while the AEAD engine still references them wasCVE-2026-23414 · Linux kernel (net/tls)High
- Linux kernel mlx5_core IPsec full offload (ESN handling): The extended-sequence-number wrap event can be processedCVE-2026-23440 · Linux kernel mlx5_core IPsec full offload (ESN handling)High
- Linux kernel (net/xfrm): One crafted inner IPv4 header (tot_len = 0) inside an IPTFS payload puts the receive path intoCVE-2026-31472 · Linux kernel (net/xfrm)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.