CVE-2026-54873

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description The QUIC process may retain memory for packet buffers longer than necessary. A remote peer can exploit this by sending maliciously crafted packets, forcing the local QUIC stack to keep packet buffer memory allocated for a duration controlled by the attacker. This occurs because the QUIC stack leaves stream data on the packet buffer to avoid a copy operation until the data is moved to a buffer provided by the local receiving application. This design allows an attacker to allocate significantly more memory than required by the data in the receiving stream buffer, leading to allocation of resources without limits or throttling.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.