CVE-2026-42772

/// Technical description

Issue summary: The QUIC stream reassembly algorithm performance deteriorates

progressively as packets are arriving out of order. The worst case has

a quadratic complexity proportional to the number of stream frames kept in

the buffer for the received stream data.

Impact summary: A remote QUIC peer that completes the handshake can create

a connection-scoped CPU pressure and potentially a Denial of Service using

compliant STREAM frames inside the advertised receive window, with low

attacker bandwidth.

CWE: CWE-407: Inefficient Algorithmic Complexity

Description: OpenSSL manages received QUIC stream fragments using a

doubly-linked list. While it optimizes for append operations (at the end of

the list), it falls back to a head-to-tail linear search for any fragment

that does not immediately follow the current `tail`.

By manipulating the sequence of offsets, an attacker can force the server

to perform O(n^2) operations, consuming excessive CPU time for the

QUIC process.

FIPS impact: no

/// Remediation

Check the references section for vendor advisories and patches from openssl. Update openssl to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References