CVE-2026-42764: OpenSSL QUIC Server DoS Vulnerability

CVE-2026-42764 Overview

CVE-2026-42764 is a NULL pointer dereference vulnerability [CWE-476] in the OpenSSL QUIC server implementation. An attacker can crash a QUIC server by sending an initial packet with an invalid or expired token when client address validation is disabled. The vulnerability is reachable only when the application calls SSL_new_listener() with the SSL_LISTENER_FLAG_NO_VALIDATE flag. Default OpenSSL QUIC server configurations enable address validation and are not affected. The FIPS modules in OpenSSL 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected because the vulnerable code sits outside the FIPS module boundary.

Critical Impact
A single malformed QUIC initial packet triggers process termination, resulting in a denial-of-service condition for OpenSSL QUIC servers running with address validation disabled.

Affected Products

OpenSSL QUIC server implementations with SSL_LISTENER_FLAG_NO_VALIDATE enabled
OpenSSL releases containing the QUIC server code prior to the fix commits
Applications invoking SSL_new_listener() without client address validation

Discovery Timeline

2026-06-09 - OpenSSL publishes security advisory and patch commits
2026-06-09 - CVE-2026-42764 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-42764

Vulnerability Analysis

The flaw lives in ssl/quic/quic_port.c, the OpenSSL QUIC port handler that processes incoming initial packets. When a client sends a QUIC initial packet carrying a token, the server validates the token before binding the connection to a channel. If the token is invalid or expired and address validation has been disabled by the application, the code path forgets the QUIC receive context (qrx) so a new channel can be created with valid initial encryption keys. The handler assigns qrx to a source pointer and sets qrx to NULL without first checking whether qrx was non-NULL. Subsequent code dereferences the resulting NULL pointer, causing the process to abort. The result is reliable termination of the QUIC server process and loss of service for all connected clients.

Root Cause

The root cause is missing input validation on the qrx pointer prior to assignment in the invalid-token handling branch of port_default_packet_handler(). The code assumed qrx would always be populated when the branch was reached, an assumption that does not hold when address validation is disabled and an invalid token arrives.

Attack Vector

Exploitation requires only network reachability to the QUIC listener. An attacker sends a single crafted QUIC initial packet containing an invalid or expired token to a vulnerable server. No authentication, prior session, or user interaction is required. Because QUIC runs over UDP, the source address can be spoofed, complicating attribution.

          * forget qrx so channel can create a new one
          * with valid initial encryption level keys.
          */
-        qrx_src = qrx;
-        qrx = NULL;
+        if (qrx != NULL) {
+            qrx_src = qrx;
+            qrx = NULL;
+        }
     }
 
     port_bind_channel(port, &e->peer, &hdr.dst_conn_id,

Source: OpenSSL commit 5e3ed291. The patch wraps the pointer reassignment in a NULL check so the vulnerable branch is skipped when qrx is not set.

Detection Methods for CVE-2026-42764

Indicators of Compromise

Unexpected crashes or restarts of OpenSSL-based QUIC server processes
Core dumps referencing port_default_packet_handler or quic_port.c in the stack trace
Bursts of QUIC initial packets from a single or spoofed source preceding a service outage
Repeated UDP traffic to QUIC listener ports (commonly 443/UDP) containing tokens that fail validation

Detection Strategies

Monitor process supervisors and service managers for abnormal termination of QUIC-enabled binaries linked against OpenSSL
Correlate QUIC handshake failures with subsequent process crashes in application logs
Inspect network telemetry for malformed or anomalous QUIC initial packets targeting listener endpoints
Audit application source for use of SSL_LISTENER_FLAG_NO_VALIDATE to identify exposure

Monitoring Recommendations

Enable verbose QUIC handshake logging where supported to capture token validation failures
Alert on repeated SIGSEGV or SIGABRT signals from network-facing services
Track UDP packet volumes and rates targeting QUIC ports for spike anomalies
Aggregate process crash telemetry into a SIEM for correlation with network events

How to Mitigate CVE-2026-42764

Immediate Actions Required

Inventory all applications that embed OpenSSL and use the QUIC server API
Audit codebases for any call to SSL_new_listener() that passes SSL_LISTENER_FLAG_NO_VALIDATE
Apply the upstream OpenSSL patches referenced in the security advisory as soon as fixed releases are available
Restrict exposure of QUIC listeners to trusted networks until patched

Patch Information

The fix is delivered in OpenSSL upstream commits 5e3ed291, a45a0aba, and bf29a458. Refer to the OpenSSL Security Advisory for branch-specific fixed versions and rebuild guidance.

Workarounds

Remove the SSL_LISTENER_FLAG_NO_VALIDATE flag from SSL_new_listener() calls so client address validation remains enabled
Place QUIC listeners behind a validating reverse proxy or load balancer that drops malformed initial packets
Apply rate limiting on UDP traffic to QUIC listener ports to reduce crash-loop impact

bash

# Search a codebase for use of the vulnerable flag
grep -RIn "SSL_LISTENER_FLAG_NO_VALIDATE" /path/to/source

# Verify the linked OpenSSL version of a running binary
ldd /path/to/quic_server | grep -i ssl
openssl version -a