CVE-2026-18798 - Vulnerability Details

- QUIC Server May Trigger Double Free When Processing INITIAL Packet

Description

Issue summary: QUIC server may double free QRX (QUIC record layer RX) object
when channel creation fails for initial packet.

Impact summary: Double free leads to heap corruption, which typically results in
termination of QUIC server process, leading to Denial of Service. There is so
far no evidence that this double free is exploitable for remote code execution,
thus it is considered highly improbable.

CWE: CWE-415: Double Free

Description: In order to validate initial packet, OpenSSL QUIC stack default
packet handler (port_default_packet_handler()) creates a so-called QRX object.
If the initial packet validates successfully with QRX object, the default packet
handler proceeds to channel (connection object) creation. The QRX object used
for packet validation is passed to port_bind_channel(), so it becomes part of
the newly created connection. If port_bind_channel() fails, then it also frees
the QRX object. Once port_bind_channel() returns, the port_default_packet_handler()
detects the failure and proceeds to the error branch, where the same QRX object is
freed for the second time.

The failure in port_bind_channel() function can be induced with a relatively
low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet
carries DCID (destination connection ID) which is shorter than 8 bytes, then
port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()
detects that the DCID has invalid length.

FIPS impact: no
The FIPS module is not affected, as the QUIC implementation is outside of
the OpenSSL FIPS module boundary.

Published: 2026-08-25

Score: 7.5 High

EPSS: 1.5% Low

KEV: No

Impact:

Action:

Analysis

Impact

OpenSSL's QUIC server has a double‑free flaw in its packet validation logic. When an incoming INITIAL packet fails the channel binding step, the QRX object used for validation is freed twice, corrupting the heap and causing the QUIC server process to terminate. The bug results in a denial of service; no evidence for remote code execution has been reported, making RCE unlikely.

Affected Systems

All OpenSSL releases containing the unpatched QUIC stack are potentially vulnerable. The CVE description does not list specific version ranges, so any deployment of OpenSSL with the default QUIC implementation should be considered at risk until the patch is applied.

Risk and Exploitability

The vulnerability can be triggered by sending a malformed QUIC packet containing an abnormal destination connection ID length from an external network. An attacker could use the failure path to force the server to crash, yielding repeated denial of service. The CVSS score of 7.5 reflects a high severity. The EPSS score is 1% and the issue is not listed in the CISA KEV catalog, but the lack of an exploit pathway suggests that exploitation risk is modest; however, the denial of service impact can disrupt services.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenSSL

unaffected

Version	Status	Constraints
`4.0.0`	affected	< 4.0.2
`3.6.0`	affected	< 3.6.4
`3.5.0`	affected	< 3.5.8

No data.

Vendor Product Confidence Versions

Openssl

100%

Version	Status	Scheme	Platform
`[4.0.0,4.0.2)`	affected	semver	—
`[3.6.0,3.6.4)`	affected	semver	—
`[3.5.0,3.5.8)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the OpenSSL library to the latest release that contains the patch for CVE‑2026‑18798.
If an upgrade cannot be performed immediately, disable QUIC traffic on the affected servers or block incoming QUIC packets until the library is updated.
As a temporary workaround, configure the application to reject INITIAL packets with destination connection ID length less than 8 bytes, thereby preventing the failure path that triggers the double free.

Generated by OpenCVE AI on August 26, 2026 at 15:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6465-1	openssl security update
Ubuntu USN	USN-8678-1	OpenSSL vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.01481.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af
https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c
https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4
https://nvd.nist.gov/vuln/detail/CVE-2026-18798
https://openssl-library.org/news/secadv/20260825.txt
https://www.cve.org/CVERecord?id=CVE-2026-18798

History

Wed, 26 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-18798 https://www.cve.org/CVERecord?id=CVE-2026-18798
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 25 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 25 Aug 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Openssl Openssl openssl
Vendors & Products		Openssl Openssl openssl

Tue, 25 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
Description		Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.
Title		QUIC Server May Trigger Double Free When Processing INITIAL Packet
Weaknesses		CWE-415
References		https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4 https://openssl-library.org/news/secadv/20260825.txt

Subscriptions

Openssl Openssl

MITRE

Status: PUBLISHED

Assigner: openssl

Published: 2026-08-25T12:59:04.715Z

Updated: 2026-08-25T14:15:04.879Z

Reserved: 2026-08-04T09:45:25.371Z

Link: CVE-2026-18798

Vulnrichment

Updated: 2026-08-25T14:14:52.139Z

NVD

Status : Awaiting Analysis

Published: 2026-08-25T13:17:49.813

Modified: 2026-08-28T19:46:29.323

Link: CVE-2026-18798

Redhat

Severity : Moderate

Publid Date: 2026-08-25T00:00:00Z

Links: CVE-2026-18798 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-26T16:00:07Z

Weaknesses

CWE-415
Double Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object