OpenSSL QUIC: malformed INITIAL packet double-frees the record-layer object and kills the server process

Impact

A single malformed INITIAL packet with a destination connection ID shorter than 8 bytes drives channel creation into its error path, and the QUIC RX record object is freed twice. The result is heap corruption that typically terminates the QUIC server process. This happens before any handshake completes, so there is no authentication gate and no per-connection state an operator can rate-limit on. OpenSSL states there is no evidence this is exploitable for remote code execution and considers that highly improbable. The practical exposure on a fleet is a cheap remote kill switch against any OpenSSL-based QUIC or HTTP/3 listener - inference gateways, object-storage frontends, telemetry receivers - where a crash-looping process means a service outage rather than a single tenant's problem.

Who can reach it

Anyone who can send a UDP datagram to the QUIC listener. Unauthenticated and pre-handshake, so any network path that reaches the port is enough.

What to do

Upgrade to the fixed OpenSSL release named in the 2026-08-25 OpenSSL advisory for your branch and restart every process serving QUIC. Only applications using the OpenSSL QUIC server stack are affected - if you terminate QUIC in a stack that does not use it, this one does not apply to you. Until you can patch, restricting who can reach the UDP listener limits exposure but does not fix the bug. The record does not name a fixed version for this CVE; take it from the advisory.

References

Related entries

• Linux kernel (drivers/nvme/target): Ordinary client I/O to an nvmet block-device namespace can hit a completion raceCVE-2026-23148 · Linux kernel (drivers/nvme/target)High
• Linux kernel (net/tls): The queue that pins encrypted input buffers while the AEAD engine still references them wasCVE-2026-23414 · Linux kernel (net/tls)High
• Linux kernel mlx5_core IPsec full offload (ESN handling): The extended-sequence-number wrap event can be processedCVE-2026-23440 · Linux kernel mlx5_core IPsec full offload (ESN handling)High
• Linux kernel (net/xfrm): One crafted inner IPv4 header (tot_len = 0) inside an IPTFS payload puts the receive path intoCVE-2026-31472 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): A peer that mixes zero-copy-eligible and copy-path IPTFS fragments in one datagram makesCVE-2026-31517 · Linux kernel (net/xfrm)High
• Linux kernel (drivers/iommu/amd): The AMD IOMMU busy-waits for command completion while holding its spinlock withCVE-2026-43253 · Linux kernel (drivers/iommu/amd)High