Summary
It was discovered that OpenSSL had an inefficient algorithm in its QUIC
stream reassembly implementation. A remote attacker could possibly use this
issue to cause OpenSSL to use excessive CPU resources, leading to a denial
of service. (CVE-2026-42772)
It was discovered that OpenSSL did not properly limit memory allocated for
QUIC packet buffers. A remote attacker could possibly use this issue to
cause OpenSSL to use excessive memory resources, leading to a denial of
service. (CVE-2026-54873)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 26.04 LTS 26.04:LTS | openssl | 3.5.5-1ubuntu3.7 |
Vulnerabilities 2
-
High 7.5
QUIC STREAM Fragment Metadata DoS
Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for pac…
-
Medium 5.3
Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC
Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream d…