CVE-2026-54873

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted network packets to a QUIC protocol endpoint. Because the QUIC stack retains memory in packet buffers until the receiving application reads the stream data, an attacker can manipulate data transfers to keep these buffers allocated indefinitely. This behavior leads to excessive memory consumption and can exhaust available system resources.

Last checked: 2026-09-30 21:40 UTC

• No exploitation evidence · CISA Coordinator (Assessed 2026-09-30 19:18 UTC)

References

• NVD: CVE-2026-54873
• Upstream Advisory

Fix Status by Distribution

Fix evidence last checked: 2026-10-02 19:50 UTC