CVE-2026-75804

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description The QUIC stack fails to enforce connection-level flow control for streams, although it correctly enforces stream-level limits. A remote peer can bypass the intended connection flow control window (default 768 KiB) by opening multiple streams that each remain within their individual stream-level limits. This allows a remote peer to force the local stack to allocate approximately 100MB of heap memory per connection, as the allocation is calculated as 2 x MAX STREAMS x (stream flow control limit).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.