CVE-2026-75804: OpenSSL QUIC Stack DOS Vulnerability

CVE-2026-75804 Overview

CVE-2026-75804 is a resource exhaustion vulnerability in the OpenSSL QUIC stack. The stack advertises both stream-level and connection-level flow control limits to remote peers but only enforces the stream-level limit. A malicious remote peer can open many streams and stay within each stream's limit while exceeding the aggregate connection-level allocation. This forces the local QUIC stack to allocate roughly 100MB of heap memory per connection instead of the intended 768 KiB default window. The flaw is classified under CWE-770: Allocation of Resources Without Limits or Throttling. The OpenSSL FIPS module is not affected because the QUIC implementation sits outside the FIPS module boundary.

Critical Impact
A remote unauthenticated attacker can force a vulnerable OpenSSL QUIC endpoint to allocate approximately 100MB of heap memory per connection, enabling memory exhaustion denial-of-service attacks against QUIC servers.

Affected Products

OpenSSL versions containing the QUIC stack with the vulnerable flow control implementation in ssl/quic/quic_fc.c
Applications and services linking against affected OpenSSL builds that expose QUIC endpoints
Non-FIPS deployments only (FIPS module is out of scope for QUIC)

Discovery Timeline

2026-09-29 - CVE-2026-75804 published to NVD
2026-09-29 - OpenSSL Security Advisory 20260929 released
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-75804

Vulnerability Analysis

QUIC uses two independent flow control counters. The stream flow control limit caps how many bytes a peer may send on a single stream. The connection flow control limit caps the aggregate byte count across all streams on a connection. Both must be validated whenever a STREAM frame arrives, and exceeding either must trigger a FLOW_CONTROL_ERROR connection close.

The vulnerable OpenSSL QUIC stack validates only the stream-level limit. Because the connection-level counter is never checked, the receiver can be forced to buffer far more data than the advertised connection window permits.

Root Cause

The defect lies in the receive flow control implementation in ssl/quic/quic_fc.c. The parent (connection-level) flow controller was not consulted when validating incoming stream data, so its error state was never propagated. The fix modifies the error-code lookup so the parent controller's error is returned when the stream controller reports no error, ensuring connection-level violations are surfaced and enforced.

Attack Vector

Exploitation requires a network-reachable QUIC endpoint and no authentication. Three conditions must hold:

The remote peer opens multiple streams (up to MAX_STREAMS, default 100 bidirectional plus 100 unidirectional).
Each stream stays within the stream-level flow control window (default 512 KiB).
No zero-offset byte is sent on any stream, preventing the receiver from consuming buffered data.

With these conditions met, the receiver buffers 2 x MAX_STREAMS x stream_window bytes, approximately 100MB per connection. An attacker opening many parallel connections can exhaust server memory.

// Patch excerpt from ssl/quic/quic_fc.c
{
    int r = rxfc->error_code;

-   if (clear)
+   if (r == OSSL_QUIC_ERR_NO_ERROR && rxfc->parent != NULL)
+       r = rxfc->parent->error_code;
+
+   /*
+    * The clear argument is used for testing only.
+    */
+   if (clear) {
        rxfc->error_code = 0;
+       if (rxfc->parent != NULL)
+           rxfc->parent->error_code = 0;
+   }

    return r;
}

Source: OpenSSL commit 2e8f546. The patch ensures the parent (connection-level) flow controller's error state is returned when the stream-level controller reports no error, propagating connection-level violations up the call stack.

Detection Methods for CVE-2026-75804

Indicators of Compromise

Sustained high heap memory usage in processes terminating QUIC connections, correlated with a small number of remote peers.
QUIC connections exhibiting many concurrently opened streams with non-zero starting offsets and no forward progress on stream consumption.
Unexpected process kills by the OOM killer on hosts running QUIC-enabled OpenSSL services.

Detection Strategies

Inventory processes linked against OpenSSL that expose QUIC listeners, using package managers, SBOMs, and runtime binary analysis.
Monitor QUIC server metrics for anomalous per-connection memory growth exceeding the advertised connection flow control window.
Correlate network telemetry to identify sources opening near-MAX_STREAMS counts of streams without transmitting the zero-offset byte.

Monitoring Recommendations

Alert on QUIC-enabled service resident set size (RSS) growth that outpaces active connection counts.
Log and review FLOW_CONTROL_ERROR events after patching to confirm enforcement is active.
Track OpenSSL version fingerprints across the environment and flag hosts running vulnerable builds.

How to Mitigate CVE-2026-75804

Immediate Actions Required

Upgrade OpenSSL to a fixed release as specified in the OpenSSL Security Advisory 20260929.
Rebuild and redeploy any statically linked binaries that embed the vulnerable OpenSSL QUIC stack.
Restart long-running services after upgrade to ensure the patched library is loaded.

Patch Information

The fix is delivered through OpenSSL upstream commits 2e8f546, 4533ee8, 64d3102, and f9eaecf. The patch propagates the parent connection-level flow controller's error state, ensuring aggregate byte limits are enforced when validating incoming STREAM frames.

Workarounds

Disable QUIC listeners on OpenSSL-based services where the QUIC transport is not required.
Front QUIC endpoints with a rate-limiting proxy or load balancer capable of capping per-source stream and memory usage.
Constrain per-process memory using cgroup limits so that exploitation triggers containment rather than host-wide impact.

bash

# Example: cap memory for a QUIC service via systemd to limit blast radius
sudo systemctl set-property my-quic-service.service MemoryMax=512M
sudo systemctl restart my-quic-service.service

# Verify installed OpenSSL version
openssl version -a