CVE-2026-35191

A flaw was found in OpenSSL. This vulnerability allows a remote attacker to abuse the server to amplify network traffic in a Denial of Service (DoS) attack. When the server is configured without client address validation, incoming datagrams containing multiple QUIC packets cause the server to calculate credit limits incorrectly by adding the total datagram size for each packet. Consequently, the server exceeds standard rate limits and transmits excessive response data to spoofed target addresses.

Last checked: 2026-09-30 21:40 UTC

• No exploitation evidence · CISA Coordinator (Assessed 2026-09-30 19:35 UTC)

References

• NVD: CVE-2026-35191
• Upstream Advisory

Fix Status by Distribution

Fix evidence last checked: 2026-10-03 05:45 UTC