CVE-2026-35191: OpenSSL QUIC Server DOS Vulnerability

CVE-2026-35191 Overview

CVE-2026-35191 is an expected behavior violation [CWE-440] in the OpenSSL QUIC server implementation. When the server is configured without client address validation, it incorrectly accounts for incoming datagram lengths when computing unvalidated credit. A remote attacker who can spoof source addresses can force the server to violate the RFC 9000 three-times amplification limit, enabling the OpenSSL QUIC stack to be abused as a reflector in distributed denial-of-service (DDoS) attacks.

The issue affects OpenSSL's QUIC stack only when address validation is disabled. FIPS modules are not affected because the QUIC stack lives outside the FIPS module boundary.

Critical Impact
A spoofing-capable attacker can misuse a vulnerable OpenSSL QUIC server as a DDoS amplifier, exceeding the RFC-mandated 3x unvalidated response limit.

Affected Products

OpenSSL QUIC server implementations operating with client address validation disabled
Applications and services embedding the affected OpenSSL QUIC stack as a server
Non-FIPS deployments only; FIPS modules are not impacted

Discovery Timeline

2026-09-29 - OpenSSL Security Advisory published
2026-09-29 - CVE-2026-35191 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-35191

Vulnerability Analysis

QUIC servers must confirm a peer's address before sending more than three times the data received, per RFC 9000 Section 8. This anti-amplification limit prevents attackers from using QUIC servers as reflectors in spoofed-source DDoS campaigns. When address validation is disabled on the OpenSSL QUIC server, the stack is expected to enforce the 3x cap until the TLS handshake completes.

The OpenSSL implementation adds the full datagram length to the unvalidated credit budget once per QUIC packet processed, rather than once per datagram. Because a single UDP datagram can carry multiple coalesced QUIC packets, the server can be tricked into believing the peer has transmitted several multiples of the actual byte count, inflating its permitted response volume and breaking the amplification bound.

Root Cause

The defect lives in the QUIC receive and port handling paths in ssl/quic/quic_port.c and ssl/quic/quic_rx_depack.c. Credit accounting operated on qpacket->datagram_len for every packet in the datagram, so N coalesced QUIC packets in one datagram of size L caused the server to credit N*L bytes instead of L.

Attack Vector

A remote attacker establishes an initial connection with a ClientHello and then sends a follow-up datagram containing multiple coalesced QUIC packets while spoofing the source address of a victim. The server credits the datagram length repeatedly, expands its unvalidated send budget, and emits response traffic exceeding the RFC 9000 3x ceiling toward the spoofed victim.

// Patched call site in ssl/quic/quic_port.c
         && ossl_quic_lcidm_lookup(port->lcidm, dcid, NULL,
             (void **)&ch)) {
         assert(ch != NULL);
+        ossl_quic_tx_packetiser_add_unvalidated_credit(ch->txp, e->data_len);
         ossl_quic_channel_inject(ch, e);
         return;
     }

// Removed per-packet datagram-length accounting in ssl/quic/quic_rx_depack.c
     PACKET pkt;
     OSSL_ACKM_RX_PKT ackm_data;
     uint32_t enc_level;
-    size_t dgram_len = qpacket->datagram_len;

     if (ch == NULL)
         return 0;
// Source: https://github.com/openssl/openssl/commit/0fe4442d4f8ea3af8a174046dae176e0d4717239

Detection Methods for CVE-2026-35191

Indicators of Compromise

Outbound QUIC (UDP/443 or configured QUIC port) response volume that exceeds three times the ingress byte count from the same 5-tuple prior to handshake completion.
Bursts of initial QUIC datagrams from many spoofed sources targeting a single OpenSSL-based server.
Repeated coalesced QUIC packets within single datagrams from unvalidated peers early in the handshake.

Detection Strategies

Baseline pre-handshake ingress-to-egress byte ratios per QUIC connection and alert when the ratio exceeds 3:1.
Inspect QUIC datagrams at network sensors to identify multiple coalesced Initial or Handshake packets from unvalidated peers.
Correlate spikes in QUIC egress traffic with third-party DDoS reports naming your IP space as a reflector.

Monitoring Recommendations

Track OpenSSL version strings across servers exposing QUIC and flag hosts running unpatched builds with address validation disabled.
Enable NetFlow, IPFIX, or eBPF-based telemetry on QUIC-facing interfaces to measure per-connection amplification factors.
Log QUIC handshake completion state alongside byte counters so anomalous unvalidated egress can be attributed to specific connections.

How to Mitigate CVE-2026-35191

Immediate Actions Required

Upgrade OpenSSL to a fixed release incorporating commits 0fe4442d, 2de4c35f, or e44292e5 and redeploy affected QUIC servers.
Re-enable client address validation on OpenSSL QUIC servers until patched binaries are in production.
Rate-limit unvalidated QUIC egress at the network edge to cap potential amplification even if a vulnerable server is exposed.

Patch Information

OpenSSL published fixes referenced in the OpenSSL Security Advisory. The corrective changes move unvalidated credit accounting to per-datagram granularity via ossl_quic_tx_packetiser_add_unvalidated_credit and remove the per-packet datagram-length usage. See the upstream commits 0fe4442d, 2de4c35f, and e44292e5.

Workarounds

Enable QUIC client address validation (RFC 9000 Section 8) using Retry tokens so the 3x budget is bypassed only after address confirmation.
Disable the QUIC listener on OpenSSL-based servers where QUIC is not required.
Deploy upstream UDP rate limits or DDoS scrubbing to constrain the maximum egress a single QUIC connection can generate before the handshake completes.

bash

# Verify installed OpenSSL version and confirm it includes the fix
openssl version -a

# Restart QUIC-serving processes after upgrade (example: nginx with QUIC)
systemctl restart nginx