CVE-2026-18798
- Source
- https://cve.org/CVERecord?id=CVE-2026-18798
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-18798.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-18798
- Downstream
- Related
- Published
- 2026-08-25T12:59:04Z
- Modified
- 2026-08-30T08:08:45Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- QUIC Server May Trigger Double Free When Processing INITIAL Packet
- Details
-
Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet.
Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable.
CWE: CWE-415: Double Free
Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time.
The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length.
FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.
- Database specific
{ "cna_assigner": "openssl", "cwe_ids": [ "CWE-415" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18798.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18798.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-18798
- https://openssl-library.org/news/secadv/20260825.txt
- https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af
- https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c
- https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4
Affected packages
Git / github.com/openssl/openssl
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openssl/openssl
- Events
-
IntroducedIntroducedIntroducedFixedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "4.0.0" }, { "fixed": "4.0.2" }, { "introduced": "3.6.0" }, { "fixed": "3.6.4" }, { "introduced": "3.5.0" }, { "fixed": "3.5.8" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
3.*
3.5-POST-CLANG-FORMAT-WEBKIT
3.5-PRE-CLANG-FORMAT-WEBKIT
3.6-POST-CLANG-FORMAT-WEBKIT
3.6-PRE-CLANG-FORMAT-WEBKIT
openssl-3.*
openssl-3.5.0
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
openssl-3.5.4
openssl-3.5.5
openssl-3.5.6
openssl-3.5.7
openssl-3.6.0
openssl-3.6.1
openssl-3.6.2
openssl-3.6.3
openssl-4.*
openssl-4.0.0
openssl-4.0.1
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-18798.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "119661022288608872337053385001810430410",
"length": 2615
},
"id": "CVE-2026-18798-037f5e7d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af",
"target": {
"file": "ssl/quic/quic_port.c",
"function": "port_default_packet_handler"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "22098268924943819192369195393972704405",
"length": 354
},
"id": "CVE-2026-18798-066c83d7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c",
"target": {
"file": "ssl/quic/quic_record_rx.c",
"function": "ossl_qrx_free"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "22098268924943819192369195393972704405",
"length": 354
},
"id": "CVE-2026-18798-0ab21940",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af",
"target": {
"file": "ssl/quic/quic_record_rx.c",
"function": "ossl_qrx_free"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "278229109545813161100669326983236309295",
"length": 1145
},
"id": "CVE-2026-18798-0c70e669",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4",
"target": {
"file": "ssl/quic/quic_port.c",
"function": "port_make_channel"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"208902964327613256665722212816883545306",
"168705829777658789221653880128849717094",
"210803577515893423855789188413458733979",
"110419929409533007772932125034720561892"
],
"threshold": 0.9
},
"id": "CVE-2026-18798-0ecc1827",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af",
"target": {
"file": "include/internal/quic_record_rx.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"302879372378965209241127772336534167237",
"130238884920379188540488167048822504454",
"330207632956552300617290968274893389948",
"283326832369827515539052514554886929244",
"257640999106482251919159564972131266542",
"153854344195692108990699925678087668672",
"62586097709506568834007152022439390509",
"173518026399295534122453031699044915659",
"220634060757816898941916019721213667691",
"223524205258166407385468661546071949981",
"222946259652319367688494177975061699616",
"72670394715812589996853645331114568562",
"137470818321897555349654402419838688221",
"207662393859085063259291601271933282184",
"218299489990340480259835734542321448007",
"240317816919370294957979146550487012709",
"212026193598741128301320168283450414431",
"34143215434456572105578398708501231014",
"326015943171566215203692928729706512749"
],
"threshold": 0.9
},
"id": "CVE-2026-18798-2070d7ab",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af",
"target": {
"file": "ssl/quic/quic_record_rx.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"240914215017186294226142347683450560430",
"280970976319603350876489102695075276506",
"201986303530912982414291591802365311366",
"122291995788913186127284991730518884870",
"140555896382094549831877743456149820185",
"237880501100998406062913149365496300198",
"159158186188606617066208819564524086450",
"124238564755588710792742426856006837978",
"268649481035552095078005168417860446914",
"209826582590895312080169486369012490220",
"235027939658370141158260377565341659043",
"307072972395173058556558210126024087902",
"324147777958056258312995721152071058908",
"12877131261402896114707315481900631452",
"105462976482951132750775355860472258301",
"313477172295911032488179911192765989282",
"130866503485943027730033959724675060039",
"332346663866528931114932571334699711744",
"237792002322964775224209299238072678476",
"173732613777798237107145513465431378663",
"295258306022471118505516780878668803105",
"21522683304453636071264107453376365603",
"136749429072618104842807563055438908029",
"205785115756177143566581998286125909799",
"73130217147480022529255084414845075909",
"152174808315748598615916452823248366676"
],
"threshold": 0.9
},
"id": "CVE-2026-18798-3f7f28be",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4",
"target": {
"file": "ssl/quic/quic_port.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "134414923595574163358056114025314632417",
"length": 900
},
"id": "CVE-2026-18798-47d88aa6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c",
"target": {
"file": "ssl/quic/quic_port.c",
"function": "port_make_channel"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "119661022288608872337053385001810430410",
"length": 2615
},
"id": "CVE-2026-18798-5168b3dd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4",
"target": {
"file": "ssl/quic/quic_port.c",
"function": "port_default_packet_handler"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "101734434527069342192152941593303362747",
"length": 613
},
"id": "CVE-2026-18798-715d661b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c",
"target": {
"file": "ssl/quic/quic_record_rx.c",
"function": "ossl_qrx_new"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "22098268924943819192369195393972704405",
"length": 354
},
"id": "CVE-2026-18798-8d5969a3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4",
"target": {
"file": "ssl/quic/quic_record_rx.c",
"function": "ossl_qrx_free"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "101734434527069342192152941593303362747",
"length": 613
},
"id": "CVE-2026-18798-8e5340e4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4",
"target": {
"file": "ssl/quic/quic_record_rx.c",
"function": "ossl_qrx_new"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "119661022288608872337053385001810430410",
"length": 2615
},
"id": "CVE-2026-18798-99a99243",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c",
"target": {
"file": "ssl/quic/quic_port.c",
"function": "port_default_packet_handler"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"240914215017186294226142347683450560430",
"280970976319603350876489102695075276506",
"290089461392437232983322503000153841344",
"128709766597416488715346669670240343554",
"219904224256561849095734172445101509905",
"237880501100998406062913149365496300198",
"159158186188606617066208819564524086450",
"124238564755588710792742426856006837978",
"268649481035552095078005168417860446914",
"209826582590895312080169486369012490220",
"235027939658370141158260377565341659043",
"307072972395173058556558210126024087902",
"324147777958056258312995721152071058908",
"12877131261402896114707315481900631452",
"105462976482951132750775355860472258301",
"313477172295911032488179911192765989282",
"130866503485943027730033959724675060039",
"332346663866528931114932571334699711744",
"237792002322964775224209299238072678476",
"173732613777798237107145513465431378663",
"295258306022471118505516780878668803105",
"21522683304453636071264107453376365603",
"136749429072618104842807563055438908029",
"205785115756177143566581998286125909799",
"73130217147480022529255084414845075909",
"152174808315748598615916452823248366676"
],
"threshold": 0.9
},
"id": "CVE-2026-18798-a39f26d1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c",
"target": {
"file": "ssl/quic/quic_port.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"208902964327613256665722212816883545306",
"168705829777658789221653880128849717094",
"210803577515893423855789188413458733979",
"110419929409533007772932125034720561892"
],
"threshold": 0.9
},
"id": "CVE-2026-18798-ae1b4b2e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4",
"target": {
"file": "include/internal/quic_record_rx.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"302879372378965209241127772336534167237",
"130238884920379188540488167048822504454",
"330207632956552300617290968274893389948",
"283326832369827515539052514554886929244",
"257640999106482251919159564972131266542",
"153854344195692108990699925678087668672",
"62586097709506568834007152022439390509",
"173518026399295534122453031699044915659",
"220634060757816898941916019721213667691",
"223524205258166407385468661546071949981",
"222946259652319367688494177975061699616",
"72670394715812589996853645331114568562",
"137470818321897555349654402419838688221",
"207662393859085063259291601271933282184",
"218299489990340480259835734542321448007",
"240317816919370294957979146550487012709",
"212026193598741128301320168283450414431",
"34143215434456572105578398708501231014",
"326015943171566215203692928729706512749"
],
"threshold": 0.9
},
"id": "CVE-2026-18798-d4087c5c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4",
"target": {
"file": "ssl/quic/quic_record_rx.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"302879372378965209241127772336534167237",
"130238884920379188540488167048822504454",
"330207632956552300617290968274893389948",
"283326832369827515539052514554886929244",
"257640999106482251919159564972131266542",
"153854344195692108990699925678087668672",
"62586097709506568834007152022439390509",
"173518026399295534122453031699044915659",
"220634060757816898941916019721213667691",
"223524205258166407385468661546071949981",
"222946259652319367688494177975061699616",
"72670394715812589996853645331114568562",
"137470818321897555349654402419838688221",
"207662393859085063259291601271933282184",
"218299489990340480259835734542321448007",
"240317816919370294957979146550487012709",
"212026193598741128301320168283450414431",
"34143215434456572105578398708501231014",
"326015943171566215203692928729706512749"
],
"threshold": 0.9
},
"id": "CVE-2026-18798-d4595646",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c",
"target": {
"file": "ssl/quic/quic_record_rx.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "134414923595574163358056114025314632417",
"length": 900
},
"id": "CVE-2026-18798-db240794",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af",
"target": {
"file": "ssl/quic/quic_port.c",
"function": "port_make_channel"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "101734434527069342192152941593303362747",
"length": 613
},
"id": "CVE-2026-18798-e7bff048",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af",
"target": {
"file": "ssl/quic/quic_record_rx.c",
"function": "ossl_qrx_new"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"240914215017186294226142347683450560430",
"280970976319603350876489102695075276506",
"290089461392437232983322503000153841344",
"128709766597416488715346669670240343554",
"219904224256561849095734172445101509905",
"237880501100998406062913149365496300198",
"159158186188606617066208819564524086450",
"124238564755588710792742426856006837978",
"268649481035552095078005168417860446914",
"209826582590895312080169486369012490220",
"235027939658370141158260377565341659043",
"307072972395173058556558210126024087902",
"324147777958056258312995721152071058908",
"12877131261402896114707315481900631452",
"105462976482951132750775355860472258301",
"313477172295911032488179911192765989282",
"130866503485943027730033959724675060039",
"332346663866528931114932571334699711744",
"237792002322964775224209299238072678476",
"173732613777798237107145513465431378663",
"295258306022471118505516780878668803105",
"21522683304453636071264107453376365603",
"136749429072618104842807563055438908029",
"205785115756177143566581998286125909799",
"73130217147480022529255084414845075909",
"152174808315748598615916452823248366676"
],
"threshold": 0.9
},
"id": "CVE-2026-18798-f7647455",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af",
"target": {
"file": "ssl/quic/quic_port.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"208902964327613256665722212816883545306",
"168705829777658789221653880128849717094",
"210803577515893423855789188413458733979",
"110419929409533007772932125034720561892"
],
"threshold": 0.9
},
"id": "CVE-2026-18798-fd5c343a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c",
"target": {
"file": "include/internal/quic_record_rx.h"
}
}
]
vanir_signatures_modified
"2026-08-30T08:08:45Z"