CVE-2026-84784

/// Technical description

Issue summary: A malicious remote peer may flood the local QUIC

stack with NEW_CONNECTION_ID frames by avoiding a limit check on

how many connection IDs the remote QUIC stack can use.

Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame

for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID

frame is dispatched via the Control Frame Queue (CFQ). If the remote

peer also withholds ACKs, then it can force the local stack

to allocate ~400MB (depending on ACK delay).

CWE: CWE-770: Allocation of Resources Without Limits or Throttling

Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism

by which a remote peer can notify the local QUIC stack to change the

destination connection ID (a.k.a. CID) the local stack uses to

identify the connection at the remote peer. Each CID is associated

with a sequence number. The sequence number is transmitted

in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID

which is being either associated wi

/// Remediation

Check the references section for vendor advisories and patches from openssl. Update openssl to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References