CVE-2026-14456

Name of the Vulnerable Software and Affected Versions OpenSSL versions 3.5 and later

Description An OpenSSL QUIC server can allocate and queue new incoming channels without enforcing a limit when processing valid QUIC Initial packets for unknown destination connection IDs. The system uses the Connection-Id from the packet header to locate an existing connection; if none is found and the packet type is INITIAL, a new channel object is allocated and queued to be accepted by the local application via the SSL accept() function. If the application cannot call SSL accept() frequently enough, the memory used for these channel objects can grow without bounds, potentially leading to a Denial of Service by making the QUIC listener unavailable.

Recommendations Update OpenSSL to a version that implements a limit for pending connections. Applications can adjust the default limit of 256 pending connections by using the SSL set value uint() function.