CVE-2026-95691

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description An issue exists in the OpenSSL QUIC client where a retransmitted QUIC CRYPTO frame can trigger the release of packet storage while the TLS record layer still maintains a direct pointer to that storage. This leads to a heap-use-after-free read, a condition where the system continues to use a memory address after it has been marked as free. A malicious QUIC server can exploit this to cause a Denial-of-Service of the client application or leak a small amount of heap memory information, including one allocator-adjacent byte, through the client's protected Handshake response.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.