The OpenSSL QUIC server, when address validation is disabled, can accumulate packet credit for every packet in a datagram as the full datagram length, allowing a spoofed sender to make the server believe it has received more data than it actually has. This violates the RFC 9000 amplification limit of no more than three times the data received, enabling an attacker to use the server as part of a denial‑of‑service amplification attack.

All systems running the OpenSSL QUIC server component are potentially affected. The vulnerability is specific to the server‑side QUIC implementation in OpenSSL and does not impact other parts of the library or FIPS modules. Version information for the affected builds was not supplied in the advisory.

The flaw can be exploited from the internet by sending carefully crafted spoofed QUIC packets to a target that has disabled address validation. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the potential to amplify traffic by up to three times the inbound data presents a significant risk. The CVSS score of 3.7 indicates low severity, yet the amplification capability keeps the threat relevant. The vulnerability is active and does not require privileged local access; it can be triggered by remote attackers with the ability to send UDP packets to the QUIC server.