Remote peers can flood an OpenSSL QUIC stack with PATH_CHALLENGE frames, causing the local system to allocate a PATH_RESPONSE frame for each challenge. Because the remote peer never acknowledges the responses, the allocated frames persist on the heap, leading to unbounded memory growth that can eventually exhaust the server or client memory and cause the application to terminate unexpectedly. This weakness permits an attacker to trigger a denial‑of‑service condition without requiring elevated privileges on the target system.

All OpenSSL implementations that include a QUIC stack, except those built with the FIPS modules 4.0, 3.6, 3.5, 3.4, and 3.0, are vulnerable. The specific affected versions are not enumerated in the advisory; any build that has the unpatched QUIC path challenge handler is at risk until the official fix is applied.

The severity of an exploitation attempt depends on the ability of a remote party to send large volumes of QUIC PATH_CHALLENGE frames to the vulnerable host. With no authentication required, an attacker can initiate a QUIC connection over the network and repeatedly issue the frames. The resulting memory exhaustion can bring the affected application to a halt. Although no EPSS score is available and the vulnerability is not listed in CISA's KEV catalog, the unbounded memory allocation and lack of mitigation make the risk high, especially for systems that expose QUIC endpoints to the internet.