The OpenSSL QUIC server, when configured to skip address validation, incorrectly calculates the unvalidated credit limit. When processing a datagram containing multiple QUIC packets, the server adds the total length of the entire datagram to the credit limit for every individual packet contained within it. This behavior allows a remote attacker to spoof packets and trick the server into believing more data was received than actually occurred, violating the RFC 9000 amplification limit of three times the received data. Consequently, a remote attacker could leverage the server to amplify a Distributed Denial of Service (DDoS) attack.