A malfunction in OpenSSL’s QUIC stack causes the implementation to retain metadata for every ACK‑only packet without releasing it. When a malicious peer completes a QUIC handshake and repeatedly triggers ACK‑only packets—such as by sending many PING frames—and withholds ACKs for other traffic, the OpenSSL side can accumulate excessive memory usage. This unchecked growth may eventually exhaust RAM, leading to a denial of service. The weakness is a classic resource allocation flaw (CWE‑770).

The flaw resides in OpenSSL’s QUIC component and therefore applies to any OpenSSL installation that supports QUIC. The vendor product affected is OpenSSL, with no publicly stated version range in the advisory. Users should consider the possibility that recent releases may also be impacted until a patch is applied.

A remote attacker who can establish a QUIC connection can exploit the bug. Because the defect is not limited by authentication or privileged access and the packet retention occurs for the entire lifetime of the connection, the attack can be launched from any external endpoint that the server accepts QUIC traffic on. The CVSS score is 7.5, the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the potential for sustained traffic or many concurrent connections makes this a high‑risk denial of service scenario that attackers could use to cripple affected services.