The vulnerability lies in the QUIC stream reassembly algorithm in OpenSSL. When packets arrive out of order, the implementation falls back to a linear search over a doubly‑linked list, leading to a worst‑case quadratic time complexity proportional to the number of fragments held in the buffer. An attacker who completes the QUIC handshake can manipulate fragment offsets to force the server into O(n²) operations, consuming excessive CPU time. This results in a remote denial of service, with the attacker able to induce the effect using only low bandwidth traffic.

All OpenSSL deployments that include the QUIC reassembly code are affected. The specific affected product is the OpenSSL library itself; no version range was specified in the CVE data, so any build that contains the current QUIC implementation is potentially impacted.

The CVSS score is 5.3, indicating moderate severity. The exploit requires only a standard QUIC connection and low bandwidth from the attacker. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. The risk is therefore moderate: the impact is service disruption, and the condition for exploitation is readily achievable by any remote QUIC client that can complete a handshake. The attack vector is network‑based and can be initiated through normal traffic to the affected server.