A NULL pointer dereference is triggered in the OpenSSL QUIC server when it receives an initial packet with an invalid or expired token while address validation is turned off. This flaw causes the server process to terminate abnormally, resulting in a denial of service. The issue is rooted in missing null checks and is identified as CWE‑476.

The vulnerability affects OpenSSL implementations that expose a QUIC server and have address validation disabled. Any OpenSSL deployment that uses QUIC must verify that SSL_LISTENER_FLAG_NO_VALIDATE is not enabled; the default configuration has validation on, so the problem is avoided unless the developer explicitly disables it. FIPS modules 4.0, 3.6, 3.5, 3.4, and 3.0 are not impacted because the vulnerable code lies outside the FIPS boundary.

The flaw is not listed in CISA’s KEV catalog and no EPSS score is available, with a CVSS score of 7.5 indicating high severity, yet publicly documented exploitation is not known. However, the vulnerability can be exploited remotely by an attacker who can send crafted QUIC packets to the target. Because the fault leads to a crash, the impact is a complete loss of service for the affected QUIC endpoint. The risk is high for any publicly reachable QUIC server that has disabled address validation, even though the default configuration is safe.