CVE-2026-75804

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) due to missing connection-level flow control enforcement in the QUIC protocol implementation. By opening multiple streams that respect individual stream limits while preventing data consumption, the attacker can force the system to buffer far more data than permitted by the connection limit. This excessive memory allocation can exhaust available system resources and degrade or terminate the service.

Last checked: 2026-10-08 01:48 UTC

• No exploitation evidence · CISA Coordinator (Assessed 2026-09-29 17:15 UTC)

References

• NVD: CVE-2026-75804
• Upstream Advisory

Fix Status by Distribution

Fix evidence last checked: 2026-10-22 06:27 UTC