Remote peers can flood an OpenSSL QUIC stack with PATH_CHALLENGE frames, causing the local system to allocate a PATH_RESPONSE frame for each challenge. Because the remote peer never acknowledges the responses, the allocated frames persist on the heap, leading to unbounded memory growth that can eventually exhaust server or client memory and cause the application to terminate unexpectedly. This weakness—an unchecked memory allocation flaw (CWE‑1325) and an unbounded allocation issue (CWE‑770)—permits an attacker to trigger a denial‑of‑service condition without requiring elevated privileges on the target system.

All OpenSSL implementations that include a QUIC stack, except those built with the FIPS modules 4.0, 3.6, 3.5, 3.4, and 3.0, are vulnerable. The specific affected versions are not enumerated in the advisory; any build that has the unpatched QUIC path challenge handler is at risk until the official fix is applied.

Remote peers can flood a vulnerable OpenSSL QUIC stack with PATH_CHALLENGE frames, causing each challenge to trigger allocation of a PATH_RESPONSE that is never freed because the malicious peer never acknowledges it. This unbounded heap growth can exhaust system memory and lead to termination of the application, creating a denial‑of‑service condition. The CVSS score of 7.5 indicates a high severity, while the EPSS < 1% suggests a low probability of active exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, but the lack of authentication and the ability to force arbitrary memory consumption make it a significant risk for exposed QUIC endpoints. The attack vector is straightforward: an attacker initiates a QUIC connection and repeatedly sends PATH_CHALLENGE frames without reciprocity. The flaw involves both unchecked memory allocation (CWE‑1325) and unbounded memory allocation (CWE‑770).