CVE-2026-54873 - Vulnerability Details

Description

Issue summary: QUIC process may keep memory for QUIC packet
buffer for much longer period than necessary.

Impact summary: Remote peer can exploit this vulnerability
by sending maliciously crafted packets, making the local
QUIC stack to keep the memory for packet buffers allocated.
The time for which the memory remains allocated is entirely
under the control of the potentially malicious remote peer.

CWE: CWE-770: Allocation of Resources Without Limits or Throttling

Description: To save copy operation from the packet buffer to the
stream reassemble buffer the QUIC stack leaves the stream data
on the packet buffer waiting to be copied to a buffer provided
by the local receiving application. The QUIC stack releases
a reference to the packet buffer only after the data are copied
to the application buffer. This design is more efficient for
legitimate data transfers but enables an attacker to allocate a lot
more memory than actually required by the data kept in the receiving
stream buffer.

To mitigate the vulnerability, the QUIC stack now calculates
and monitors memory overhead for every stream. The memory overhead
for a single stream frame is calculated as a difference between the
size of the whole packet that carries the stream frame and the size
of the stream frame itself. The memory overhead for a single stream
frame is added to the total (cumulative) memory overhead QUIC stack
keeps for each stream. Once the cumulative memory overhead exceeds
64kB, the QUIC stack moves the stream frame data from the packet
buffer to the stream buffer, starting with the next packet received.

FIPS impact: no
The FIPS module is not affected as the QUIC implementation is outside of
the OpenSSL FIPS module boundary.

Published: 2026-09-29

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises because the OpenSSL QUIC stack keeps packet buffers allocated for longer than necessary when reassembling stream data. A remote peer can send maliciously crafted QUIC packets and control how long these buffers remain allocated. The excessive allocation of memory, limited only by the size of the data queued for reassembly, can deplete system resources and lead to a denial of service. This weakness is a classic example of Allocation of Resources Without Limits, reflected in CWE‑770.

Affected Systems

The affected product is OpenSSL. No specific sub‑version information is listed in the CVE data, so any build of OpenSSL containing the pre‑patch QUIC implementation may be vulnerable.

Risk and Exploitability

The attack vector is remote, inferred from the description that a malicious peer can send crafted packets. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only network connectivity to a QUIC‑enabled OpenSSL instance; no special privileges are needed. Because the attacker can control how long buffers remain allocated, the impact is primarily on availability through memory exhaustion, and the CVSS score of 7.5 indicates a high severity.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenSSL

unaffected

Version	Status	Constraints
`4.0.0`	affected	< 4.0.3
`3.6.0`	affected	< 3.6.5
`3.5.0`	affected	< 3.5.9
`3.4.0`	affected	< 3.4.8

Configuration 1 [-]

OR	cpe:2.3:a:openssl:openssl::::::::
	cpe:2.3:a:openssl:openssl::::::::
	cpe:2.3:a:openssl:openssl::::::::
	cpe:2.3:a:openssl:openssl::::::::

No data.

Vendor Product Confidence Versions

Openssl

100%

Version	Status	Scheme	Platform
`[4.0.0,4.0.3)`	affected	semver	—
`[3.6.0,3.6.5)`	affected	semver	—
`[3.5.0,3.5.9)`	affected	semver	—
`[3.4.0,3.4.8)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update OpenSSL to a version that includes the QUIC buffer memory limit patch referenced in the listed commits
Restart any services or applications that link against the updated OpenSSL library so the fix takes effect
If upgrading is not possible, disable QUIC support in the affected application to eliminate the attack surface

Generated by OpenCVE AI on September 30, 2026 at 23:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6531-1	openssl security update
Ubuntu USN	USN-8861-1	OpenSSL vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00696.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23
https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53
https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb
https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2
https://nvd.nist.gov/vuln/detail/CVE-2026-54873
https://openssl-library.org/news/secadv/20260929.txt
https://www.cve.org/CVERecord?id=CVE-2026-54873

History

Thu, 08 Oct 2026 01:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:openssl:openssl::::::::

Wed, 30 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Wed, 30 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-54873 https://www.cve.org/CVERecord?id=CVE-2026-54873
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` threat_severity `Moderate`

Tue, 29 Sep 2026 18:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Openssl Openssl openssl
Vendors & Products		Openssl Openssl openssl

Tue, 29 Sep 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains allocated is entirely under the control of the potentially malicious remote peer. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: To save copy operation from the packet buffer to the stream reassemble buffer the QUIC stack leaves the stream data on the packet buffer waiting to be copied to a buffer provided by the local receiving application. The QUIC stack releases a reference to the packet buffer only after the data are copied to the application buffer. This design is more efficient for legitimate data transfers but enables an attacker to allocate a lot more memory than actually required by the data kept in the receiving stream buffer. To mitigate the vulnerability, the QUIC stack now calculates and monitors memory overhead for every stream. The memory overhead for a single stream frame is calculated as a difference between the size of the whole packet that carries the stream frame and the size of the stream frame itself. The memory overhead for a single stream frame is added to the total (cumulative) memory overhead QUIC stack keeps for each stream. Once the cumulative memory overhead exceeds 64kB, the QUIC stack moves the stream frame data from the packet buffer to the stream buffer, starting with the next packet received. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.
Title		QUIC STREAM Fragment Metadata DoS
Weaknesses		CWE-770
References		https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23 https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53 https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2 https://openssl-library.org/news/secadv/20260929.txt

Subscriptions

Openssl Openssl

MITRE

Status: PUBLISHED

Assigner: openssl

Published: 2026-09-29T15:32:16.134Z

Updated: 2026-09-30T20:11:09.162Z

Reserved: 2026-06-16T10:18:08.635Z

Link: CVE-2026-54873

Vulnrichment

Updated: 2026-09-30T19:18:05.353Z

NVD

Status : Analyzed

Published: 2026-09-29T16:17:08.763

Modified: 2026-10-08T01:19:18.200

Link: CVE-2026-54873

Redhat

Severity : Moderate

Publid Date: 2026-09-29T15:32:16Z

Links: CVE-2026-54873 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-30T23:45:09Z

Weaknesses

CWE-770
Allocation of Resources Without Limits or Throttling

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object