CVE-2026-42772

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description An inefficient algorithmic complexity issue exists in the QUIC stream reassembly process. OpenSSL uses a doubly-linked list to manage received QUIC stream fragments; while append operations are optimized, any fragment that does not immediately follow the current tail triggers a head-to-tail linear search. A remote peer that has completed the handshake can manipulate the sequence of offsets using compliant STREAM frames within the advertised receive window to force the server into O(n^2) operations. This results in progressive performance deterioration and excessive CPU pressure, potentially leading to a Denial of Service with low attacker bandwidth.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.