CVE-2026-75804

A denial of service vulnerability of moderate severity was found in the OpenSSL QUIC implementation. The QUIC stack enforces the per-stream flow control limit but does not enforce the connection-level flow control limit. A remote, unauthenticated peer can exploit this by opening multiple streams that each stay within the per-stream limit while sending no zero-offset byte (which prevents the stack from consuming the data), forcing the local QUIC stack to buffer far more data than the connection limit permits. With default settings (a maximum of 200 streams and a 512 KiB per-stream window), a malicious peer can drive the stack to allocate roughly 100 MB of heap per connection instead of the default 768 KiB connection window, which can exhaust memory and degrade or terminate the affected service. There is no impact on confidentiality or integrity. Red Hat rates this issue as Moderate severity (CVSS 3.1 score 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), whereas upstream OpenSSL classified it as Low severity.

Only OpenSSL versions that contain the QUIC stack are affected. Red Hat Enterprise Linux streams shipping OpenSSL 1.x (including the openssl 1.0.x/1.1.1, compat-openssl10, compat-openssl11, and mingw-openssl 1.x components on RHEL 6, 7, and 8 streams) are not affected because the vulnerable QUIC code is not present in those versions. Affected Red Hat products that ship an OpenSSL version with the QUIC stack are being addressed through their respective update streams; for a number of these products the fix is deferred to a future scheduled update given the denial-of-service-only nature of this flaw. The residual risk of deferral is limited to remote memory-exhaustion denial of service against applications that use the OpenSSL QUIC API. The OpenSSL FIPS module is not affected because the QUIC implementation is outside the FIPS module boundary.