Openssl · Openssl · CVE-2026-18798
**Name of the Vulnerable Software and Affected Versions**
OpenSSL versions prior to 3.5.3-8.1
**Description**
A double free issue exists in the QUIC server when processing an INITIAL packet. The default packet handler `port default packet handler()` creates a QRX (QUIC record layer RX) object for packet validation. If the subsequent channel creation via `port bind channel()` fails, the QRX object is freed. However, `port default packet handler()` also attempts to free the same QRX object upon detecting the failure, leading to heap corruption and a Denial of Service (DoS) through process termination.
This condition can be triggered by sending a malformed INITIAL packet where the `DCID` (destination connection ID) is shorter than 8 bytes, causing `port bind channel()` to fail after `ossl quic lcidm enrol odcid()` detects the invalid length.
**Recommendations**
Update to version 3.5.3-8.1 or later.