CVE-2026-54873

/// Technical description

Issue summary: QUIC process may keep memory for QUIC packet

buffer for much longer period than necessary.

Impact summary: Remote peer can exploit this vulnerability

by sending maliciously crafted packets, making the local

QUIC stack to keep the memory for packet buffers allocated.

The time for which the memory remains allocated is entirely

under the control of the potentially malicious remote peer.

CWE: CWE-770: Allocation of Resources Without Limits or Throttling

Description: To save copy operation from the packet buffer to the

stream reassemble buffer the QUIC stack leaves the stream data

on the packet buffer waiting to be copied to a buffer provided

by the local receiving application. The QUIC stack releases

a reference to the packet buffer only after the data are copied

to the application buffer. This design is more efficient for

legitimate data transfers but enables an attacker to allocate a lot

more memory than actually required by the data kept in the receiving

stream buffer.

/// Remediation

Check the references section for vendor advisories and patches from openssl. Update openssl to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References