OpenSSL's QUIC stack implements per‑stream flow control but does not enforce the connection‑level limit. A remote peer can therefore send data that fits within individual stream limits while collectively exceeding the connection window. When this happens the library allocates memory proportional to the number of open streams times the stream window size. Because MAX_STREAMS defaults to 100 and the stream window is 512 kB, an attacker can force approximately 100 MB of heap consumption per connection, exhausting system resources. This behaviour represents a classic resource‑allocation weakness (CWE‑770) that can lead to denial of service.

Vendors affected are all releases of the OpenSSL library that include the QUIC implementation. The issue is tied to the OpenSSL project and applies to any build that compiles the current QUIC stack. No specific product or version boundaries are listed; administrators should assume all recent releases of OpenSSL are potentially vulnerable until a patch is applied.

The vulnerability has a CVSS score of 5.3, indicating a moderate severity. No EPSS score is published and the flaw is not listed in CISA's KEV catalog, suggesting lower public exploitation pressure. Nonetheless, the attack requires a remote QUIC client that can open multiple streams and send data without a zero‑offset byte, a scenario that is realistic for any QUIC‑enabled server. An attacker who succeeds can trigger the target process to allocate large amounts of memory, potentially crashing the service or forcing the operating system to reclaim memory, thus causing a denial of service. Based on the description, the likely attack vector is a remote adversary exploiting the QUIC protocol over a network connection.