The vulnerability resides in the OpenSSL QUIC server routine that handles inbound QUIC packets. When a packet with the INITIAL type arrives for a connection ID that does not yet exist, the server allocates a new channel object and places it in a queue awaiting the application’s SSL_accept call. Because no upper bound is enforced on how many such pending connections may be queued, an attacker that floods the server with many INITIAL packets can cause the memory dedicated to per‑channel state to grow without limits, eventually exhausting system resources and rendering the QUIC listener unavailable. The weakness is a classic case of resource exhaustion (CWE‑770).

This flaw is present in OpenSSL starting with version 3.5, when the QUIC server implementation was first introduced. All 3.5 and later releases that contain the unmodified code are vulnerable until the patch that introduces a 256‑connection pending‑queue limit is applied. The vendor affected is OpenSSL; the product is OpenSSL, and the vulnerability affects any configured QUIC server using the listener SSL object.

The risk is high because the attack requires only the ability to send numerous QUIC Initial packets over the network to the server’s listening socket; no prior authentication or privileged access is needed. The exploitable path is straightforward: flood the listener with Initial packets for unknown destination connection IDs, forcing the server to allocate new channel objects continuously. Although EPSS data are unavailable, the fact that the vulnerability can lead to service interruption, combined with no current mitigation in place for unpatched systems, implies a substantial likelihood of exploitation. The CVSS score is not supplied, but the nature of the flaw suggests a high severity, and the vulnerability is not listed in the CISA KEV catalog.