CVE-2026-84784: OpenSSL QUIC Stack DoS Vulnerability

CVE-2026-84784 Overview

CVE-2026-84784 is a memory exhaustion denial-of-service vulnerability in the OpenSSL QUIC stack. A malicious remote peer can flood the local QUIC stack with NEW_CONNECTION_ID frames while withholding ACKs, forcing the local stack to queue a RETIRE_CONNECTION_ID frame for each one. This unbounded backlog in the Control Frame Queue (CFQ) can consume roughly 400MB of memory per targeted connection, depending on ACK delay. The flaw is tracked under CWE-770: Allocation of Resources Without Limits or Throttling. The OpenSSL FIPS module is not affected because the QUIC implementation sits outside the FIPS module boundary.

Critical Impact
A single malicious QUIC peer can exhaust ~400MB of memory per connection on the local stack, enabling a low-cost remote denial-of-service against OpenSSL-based QUIC endpoints.

Affected Products

OpenSSL builds with QUIC support enabled (client and server)
Applications linking against affected OpenSSL versions and exposing QUIC endpoints
The OpenSSL FIPS module is not affected

Discovery Timeline

2026-09-29 - CVE-2026-84784 published to NVD
2026-09-29 - OpenSSL Security Advisory released (OpenSSL Security Advisory September 2026)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-84784

Vulnerability Analysis

RFC 9000 defines how QUIC peers rotate destination Connection IDs (CIDs) using NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames. Each NEW_CONNECTION_ID frame carries a new CID, a sequence number, and a retire-prior-to value instructing the receiver to retire all CIDs with lower sequence numbers. The local stack must transmit a RETIRE_CONNECTION_ID frame for each retired CID and keep it queued until the peer acknowledges it.

Although the OpenSSL QUIC stack supports only one destination CID per connection, an attacker can trick it into processing multiple RETIRE_CONNECTION_ID frames. Each queued frame is dispatched through the Control Frame Queue and retained until an ACK arrives. If the attacker withholds ACKs while streaming NEW_CONNECTION_ID frames, the CFQ grows without bound.

Root Cause

The OpenSSL QUIC stack retires the destination CID immediately upon receiving a NEW_CONNECTION_ID frame instead of waiting for an ACK of the corresponding RETIRE_CONNECTION_ID. This premature state transition removes the natural throttling that RFC 9000 assumes, letting the peer inject unbounded retire requests. The patch introduces a CFQ_DATA_RETIRE_CID_T structure in ssl/quic/quic_channel.c to track retire state per CID and correctly gate retirement on ACK receipt.

Attack Vector

The attack requires only network access to an OpenSSL QUIC endpoint and no authentication or user interaction. The attacker establishes a QUIC connection, sends a stream of NEW_CONNECTION_ID frames with increasing retire-prior-to values, and refuses to acknowledge the resulting RETIRE_CONNECTION_ID frames. Memory consumption grows until the host runs out of resources or the process is terminated.

// Patch excerpt from ssl/quic/quic_channel.c introducing
// per-CID retire tracking to bound the CFQ backlog.

DEFINE_LHASH_OF_EX(QUIC_SRT_ELEM);

typedef struct cfq_data_retire_cid {
    uint64_t rtcid_seq;
    QUIC_CHANNEL *rtcid_ch;
} CFQ_DATA_RETIRE_CID_T;

QUIC_NEEDS_LOCK
static QLOG *ch_get_qlog(QUIC_CHANNEL *ch)
{
    /* ... */
}
// Source: https://github.com/openssl/openssl/commit/4685c914b0d410b1034f40b547c95bc95e7a380a

Detection Methods for CVE-2026-84784

Indicators of Compromise

Sustained inbound NEW_CONNECTION_ID frames on a single QUIC connection with strictly increasing retire-prior-to values
Growing outbound queue of RETIRE_CONNECTION_ID frames that remain unacknowledged by the peer
Rapid resident memory growth (approaching several hundred MB) in processes hosting OpenSSL QUIC endpoints

Detection Strategies

Instrument QUIC endpoints to count NEW_CONNECTION_ID frames per connection and alert on anomalous rates
Correlate elevated per-process memory usage with QUIC connection identifiers to isolate abusive peers
Enable QLOG tracing on OpenSSL QUIC endpoints during triage to capture CID lifecycle events

Monitoring Recommendations

Track heap allocation trends for services exposing UDP/443 or other QUIC listeners
Monitor kernel and process-level UDP socket buffer pressure that may accompany the attack
Ingest QUIC and network telemetry into a centralized data lake to correlate frame patterns with resource metrics

How to Mitigate CVE-2026-84784

Immediate Actions Required

Inventory all applications and libraries that link against OpenSSL with QUIC enabled
Apply the fixed OpenSSL release referenced in the OpenSSL Security Advisory September 2026 as soon as it is available for your distribution
Restart services that dynamically link OpenSSL after upgrading to load the patched library

Patch Information

The fix is delivered across several upstream commits that add per-CID retire tracking and gate destination CID retirement on ACK receipt. See OpenSSL Commit 4685c91, OpenSSL Commit 9a30fe0, OpenSSL Commit dba3c48, and OpenSSL Commit e9e5155.

Workarounds

Disable QUIC listeners on OpenSSL-based services until patched builds are deployed
Rate-limit or drop QUIC traffic from untrusted networks at edge firewalls and load balancers
Enforce per-connection memory ceilings via cgroups or systemd resource controls to contain runaway allocations

bash

# Example: cap memory per QUIC service instance using systemd
# to contain unbounded CFQ growth until the patch is applied.
sudo systemctl set-property my-quic-service.service \
    MemoryMax=512M MemoryHigh=384M
sudo systemctl daemon-reload
sudo systemctl restart my-quic-service.service