CVE-2026-42772: OpenSSL QUIC Stream DOS Vulnerability

CVE-2026-42772 Overview

CVE-2026-42772 is an algorithmic complexity vulnerability [CWE-407] in the OpenSSL QUIC stream reassembly implementation. The QUIC stream reassembly algorithm degrades to quadratic complexity when packets arrive out of order. OpenSSL manages received QUIC stream fragments using a doubly-linked list optimized for append operations, but falls back to a head-to-tail linear search for any fragment that does not immediately follow the current tail. A remote QUIC peer that completes the handshake can manipulate STREAM frame offsets to force O(n^2) operations, creating connection-scoped CPU pressure with low attacker bandwidth. The OpenSSL FIPS module is not affected because the QUIC implementation is outside the FIPS module boundary.

Critical Impact
An authenticated remote QUIC peer can trigger sustained CPU exhaustion in the QUIC process using compliant STREAM frames within the advertised receive window, potentially causing denial of service.

Affected Products

OpenSSL builds with QUIC support enabled
Applications and servers linking against affected OpenSSL versions using the QUIC stack
Non-FIPS OpenSSL deployments (FIPS module boundary excludes QUIC)

Discovery Timeline

2026-09-29 - CVE-2026-42772 published to NVD
2026-09-29 - OpenSSL Security Advisory 20260929 released with patches
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-42772

Vulnerability Analysis

The defect lies in how OpenSSL stores received QUIC STREAM frame fragments. Fragments are held in a doubly-linked list keyed by stream offset. The insertion routine performs well when new fragments extend the current tail. When a fragment arrives out of order, the code walks the list from head to tail to locate the correct insertion point. Each subsequent out-of-order insertion repeats this linear scan, producing worst-case quadratic behavior relative to the number of buffered fragments.

The impact is confined to CPU consumption on the QUIC process. There is no memory corruption, information disclosure, or integrity impact. Because the attack uses standards-compliant STREAM frames sent within the receive window advertised by the server, it is difficult to distinguish from legitimate reordered traffic at the protocol layer.

Root Cause

The root cause is inefficient algorithmic complexity in the fragment reassembly data structure. The upstream fix replaces the linked-list-based reassembly with a red-black tree keyed structure. The new implementation is introduced in include/internal/quic_strm_reas.h and uses OSSL_RBT_HEAD(srange, sframe_set_t) to track buffered ranges, yielding logarithmic insertion and lookup regardless of arrival order.

Attack Vector

Exploitation requires an attacker who has completed the QUIC handshake with a vulnerable peer. The attacker then transmits STREAM frames with carefully chosen non-monotonic offsets that stay within the receive window. Each frame forces a full traversal of the buffered fragment list, amplifying CPU cost per byte sent. The condition is network-reachable, requires no user interaction, and can be sustained over a single connection with minimal attacker bandwidth.

/* Excerpt from the OpenSSL fix — new reassembly structure
 * introduces a red-black tree keyed set of stream ranges,
 * replacing the linked-list scan that caused O(n^2) behavior. */

#ifndef OSSL_QUIC_STRM_REAS_H
#define OSSL_QUIC_STRM_REAS_H

#include "internal/common.h"
#include "internal/uint_set.h"
#include "internal/quic_record_rx.h"

#ifndef OPENSSL_NO_QUIC
#include "internal/ossl_rbtree.h"

typedef struct sframe_set_t {
    OSSL_RBT_HEAD(srange, sframe_set_t)
    ranges;
    /* Is the tail frame final. */
    unsigned int fin;
    uint64_t fin_off;
    /* Number of stream frames in the list. */
    size_t stream_ranges;
    size_t stream_chunks;
    /* Offset of data not yet dropped */
    uint64_t offset;

Source: OpenSSL Commit 32d0ed8a

Detection Methods for CVE-2026-42772

Indicators of Compromise

Sustained high CPU utilization attributable to a single QUIC connection or process without commensurate throughput.
QUIC connections exhibiting repeated STREAM frames with non-monotonic offsets and small gaps within the advertised receive window.
Increased latency and packet processing delays on QUIC-enabled listeners after handshake completion from specific peers.

Detection Strategies

Correlate per-connection CPU time against bytes received; flag connections with abnormally high CPU-per-byte ratios.
Inspect QUIC telemetry for high counts of out-of-order STREAM frame arrivals per stream compared to baseline reorder rates.
Alert on process-level CPU saturation events on OpenSSL-linked services exposing QUIC endpoints.

Monitoring Recommendations

Instrument QUIC servers with per-connection CPU accounting and stream reassembly buffer depth metrics.
Track top-N QUIC peers by CPU consumption and terminate or rate-limit outliers.
Ingest server and network telemetry into a centralized analytics platform to detect low-bandwidth, high-CPU connection patterns over time.

How to Mitigate CVE-2026-42772

Immediate Actions Required

Inventory all systems running OpenSSL with QUIC enabled and identify externally reachable QUIC endpoints.
Apply the fixed OpenSSL release referenced in Security Advisory 20260929 once available for your distribution.
Constrain the maximum concurrent QUIC streams and per-connection buffered fragment counts where the server allows tuning.

Patch Information

The upstream fix reimplements QUIC stream reassembly using a red-black tree, eliminating the linear scan. Review the following commits and advisory for authoritative patch details: OpenSSL Commit 32d0ed8a, OpenSSL Commit ca8402e2, OpenSSL Commit eb2becc0, OpenSSL Commit f42ae513, and the OpenSSL Security Advisory 20260929.

Workarounds

Disable QUIC on OpenSSL-linked services if the protocol is not required for production workloads.
Terminate QUIC at an upstream proxy or load balancer not affected by this issue while the OpenSSL patch is rolled out.
Enforce aggressive per-connection CPU and rate limits and drop connections that exceed reasonable reordering thresholds.

bash

# Example: identify processes linked against OpenSSL and exposing QUIC (UDP/443)
sudo ss -ulpn 'sport = :443'

# Example: constrain per-source UDP/443 rate at the edge (nftables)
sudo nft add rule inet filter input udp dport 443 \
  meter quic_rl { ip saddr limit rate 200/second } accept
sudo nft add rule inet filter input udp dport 443 drop