CVE-2026-14456
Description
A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption can result in a Denial of Service (DoS) condition, making the QUIC listener unavailable.
Statement
Red Hat Enterprise Linux 9.8+, 10.2+, Red Hat Hardened Images, RHIVOS 2, and OpenShift 4.22 ship OpenSSL 3.5.x which includes the QUIC server implementation affected by this flaw. Earlier RHEL versions ship OpenSSL 3.2.x or below, which do not include the QUIC server feature and are not affected. The FIPS module is not affected as the QUIC implementation is outside the OpenSSL FIPS module boundary. Applications must explicitly enable the QUIC server listener to be vulnerable; simply having OpenSSL 3.5 installed does not expose the flaw.
Mitigation
Option 1: Rate-limit or Firewall Inbound QUIC (UDP 443) [Goal: Slow or block QUIC Initial packets before they reach the vulnerable listener.]
A. Confirm QUIC Exposure - Check if any service is listening on UDP 443:
$ ss -ulnp | grep ':443'
# or
$ sudo lsof -iUDP:443 -n -P
Note: If no service is listening on UDP 443, this CVE does not apply (TCP 443 is unaffected).
B. Restrict Access to UDP 443 ( Default-deny UDP 443 and allow only trusted networks:)
$ sudo firewall-cmd --permanent --remove-service=quic 2>/dev/null
$ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="443" protocol="udp" accept'
$ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="443" protocol="udp" drop'
$ sudo firewall-cmd --reload
C. Verify - Confirm the restriction by testing from an external host (the connection should fail or be throttled):
$ nc -u -v YOUR_HOST 443
Option 2: Disable QUIC Server
If QUIC/HTTP3 is not required, remove the vulnerable code path entirely and use TLS/TCP instead.
Recommended Mitigation Priority
Priority : Action
1.Confirm UDP 443 QUIC listener exists and OpenSSL version is in affected range
2.Block or rate-limit UDP 443 at firewall/edge (immediate)
3.Disable QUIC/HTTP3 on the service if not needed
4.Upgrade OpenSSL to fixed release when available
5.Application owners: set SSL_VALUE_QUIC_MAX_PENDING_CONNS if default 256 is too high
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
