CVE-2026-18798

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 3.5.3-8.1

Description A double free issue exists in the QUIC server when processing an INITIAL packet. The default packet handler port default packet handler() creates a QRX (QUIC record layer RX) object for packet validation. If the subsequent channel creation via port bind channel() fails, the QRX object is freed. However, port default packet handler() also attempts to free the same QRX object upon detecting the failure, leading to heap corruption and a Denial of Service (DoS) through process termination.

This condition can be triggered by sending a malformed INITIAL packet where the DCID (destination connection ID) is shorter than 8 bytes, causing port bind channel() to fail after ossl quic lcidm enrol odcid() detects the invalid length.

Recommendations Update to version 3.5.3-8.1 or later.