CVE-2026-88822

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description The OpenSSL QUIC stack contains a flaw in its automated peer detection mechanism used during the SSL handshake when utilizing an already connected socket. The process employs the getpeername() function with a buffer length that prevents the retrieval of larger addresses, such as IPv6. However, because the function returns the full address length and the system accepts this as the valid input buffer length, the address buffer may contain uninitialized stack data instead of the actual peer address. This results in the use of an invalid address for outgoing packets, causing connection loss and the disclosure of uninitialized stack data to passive network observers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.