CVE-2026-63075

/// Technical description

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly

sends ack-eliciting packets while not acknowledging ACK-only responses, the

QUIC stack can retain ACK-only packet metadata for the lifetime of the

connection.

Impact summary: A remote peer that can complete a QUIC handshake can

cause connection-scoped memory growth which may lead to Denial of Service

through memory exhaustion, especially with sustained traffic or many concurrent

QUIC connections.

CWE: CWE-770: Allocation of Resources Without Limits or Throttling

Description: When the OpenSSL QUIC stack sends an ACK-only packet,

there is no requirement by the QUIC protocol that the peer will acknowledge

that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL

implementation stores the metadata about the ACK frames regardless.

In and of itself that's ok, but if a malicious peer establishes a connection, and

then drives the connection such that ACK-only packets are forced from the

Op

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References