CVE-2026-34183
- Source
- https://cve.org/CVERecord?id=CVE-2026-34183
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-34183.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-34183
- Downstream
- Related
- Published
- 2026-06-09T16:03:23.623Z
- Modified
- 2026-07-17T21:00:47.280261320Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler
- Details
-
Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.
Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.
A remote peer may exhaust heap memory by flooding the local QUIC stack with PATHCHALLENGE frames. The local QUIC stack allocates a PATHRESPONSE frame for every PATHCHALLENGE it receives. The allocated PATHRESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.
The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.
- Database specific
{ "cna_assigner": "openssl", "cwe_ids": [ "CWE-1325" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34183.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34183.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-34183
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517
- https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac
- https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac
- https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb
Affected packages
Git / github.com/openssl/openssl
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openssl/openssl
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixedFixedFixed
- Database specific
{ "source": [ "CPE_RANGE", "CPE_STRING", "REFERENCES" ], "cpe": [ "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "3.4.0" }, { "fixed": "3.4.6" }, { "introduced": "3.5.0" }, { "fixed": "3.5.7" }, { "introduced": "3.6.0" }, { "fixed": "3.6.3" }, { "introduced": "4.0.0-NA" }, { "last_affected": "4.0.0-NA" } ] }
Affected versions
3.*
3.4-POST-CLANG-FORMAT-WEBKIT
3.4-PRE-CLANG-FORMAT-WEBKIT
3.5-POST-CLANG-FORMAT-WEBKIT
3.5-PRE-CLANG-FORMAT-WEBKIT
3.6-POST-CLANG-FORMAT-WEBKIT
3.6-PRE-CLANG-FORMAT-WEBKIT
4.*
4.0.0-NA
openssl-3.*
openssl-3.4.0
openssl-3.4.1
openssl-3.4.2
openssl-3.4.3
openssl-3.4.4
openssl-3.4.5
openssl-3.5.0
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
openssl-3.5.4
openssl-3.5.5
openssl-3.5.6
openssl-3.6.0
openssl-3.6.1
openssl-3.6.2
openssl-4.*
openssl-4.0.0
Database specific
vanir_signatures
[
{
"signature_version": "v1",
"target": {
"function": "ossl_quic_handle_frames",
"file": "ssl/quic/quic_rx_depack.c"
},
"signature_type": "Function",
"digest": {
"length": 720.0,
"function_hash": "336641234594347542091119058144224198347"
},
"deprecated": false,
"id": "CVE-2026-34183-02e4c251",
"source": "https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"
},
{
"signature_version": "v1",
"target": {
"file": "include/internal/quic_cfq.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"17619631997647045611390242832180276565",
"133467912692424401758276322394205795573"
]
},
"deprecated": false,
"id": "CVE-2026-34183-12c0a834",
"source": "https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"17619631997647045611390242832180276565",
"133467912692424401758276322394205795573"
]
},
"target": {
"file": "include/internal/quic_cfq.h"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-167228f5",
"source": "https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"
},
{
"signature_version": "v1",
"target": {
"function": "txp_pkt_commit",
"file": "ssl/quic/quic_txp.c"
},
"signature_type": "Function",
"digest": {
"length": 3008.0,
"function_hash": "161994472543430899723538006510755481804"
},
"deprecated": false,
"id": "CVE-2026-34183-17067a60",
"source": "https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac"
},
{
"signature_version": "v1",
"target": {
"file": "include/internal/quic_channel.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"108747366242345647591197637812625952066",
"250750693307312180336287694911741365309"
]
},
"deprecated": false,
"id": "CVE-2026-34183-1deb490c",
"source": "https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"150569026360306455806206181791882731795",
"15934604103806316593464069826954878768",
"177464121719511158010434828964609689376"
]
},
"target": {
"file": "ssl/quic/quic_channel.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-26982dc0",
"source": "https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"45128711054467000430936538387457324988",
"149330818967290373335056504883011268937",
"165174572031812930150208362394930086547"
]
},
"target": {
"file": "ssl/quic/quic_txp.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-2f762fb0",
"source": "https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac"
},
{
"signature_version": "v1",
"target": {
"file": "include/internal/quic_fifd.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"317034173942351296182659702637745233270",
"288307443070895623675948612950410069886"
]
},
"deprecated": false,
"id": "CVE-2026-34183-391e53c9",
"source": "https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517"
},
{
"digest": {
"length": 3008.0,
"function_hash": "161994472543430899723538006510755481804"
},
"target": {
"function": "txp_pkt_commit",
"file": "ssl/quic/quic_txp.c"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-3975297b",
"source": "https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"
},
{
"signature_version": "v1",
"target": {
"file": "include/internal/quic_fifd.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"317034173942351296182659702637745233270",
"288307443070895623675948612950410069886"
]
},
"deprecated": false,
"id": "CVE-2026-34183-3c651efe",
"source": "https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"
},
{
"digest": {
"length": 872.0,
"function_hash": "132626122019583303694968741362670635918"
},
"target": {
"function": "depack_do_frame_path_challenge",
"file": "ssl/quic/quic_rx_depack.c"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-3f802283",
"source": "https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"
},
{
"signature_version": "v1",
"target": {
"file": "ssl/quic/quic_channel.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125836126259094406777805326932883223191",
"60821833181468548777893932459539788475",
"296667982168421279828153649100201152846"
]
},
"deprecated": false,
"id": "CVE-2026-34183-413bbad9",
"source": "https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"55439535173121503976817818931592893497",
"127204818329041298298294467612191537359",
"50310224725132401245228365000792676619",
"241198617938439281436044265979510326836"
]
},
"target": {
"file": "ssl/quic/quic_cfq.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-4a8d14aa",
"source": "https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"
},
{
"signature_version": "v1",
"target": {
"file": "ssl/quic/quic_cfq.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"55439535173121503976817818931592893497",
"127204818329041298298294467612191537359",
"50310224725132401245228365000792676619",
"241198617938439281436044265979510326836"
]
},
"deprecated": false,
"id": "CVE-2026-34183-53d4505f",
"source": "https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"
},
{
"signature_version": "v1",
"target": {
"file": "ssl/quic/quic_channel_local.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"119843563940857191665238197175665795421",
"52907295179543340816464288799123237651",
"252177752591175264532377411353109894318",
"213320775335163836004746971640321525448",
"74619020260506909693096693632824749486",
"249561572208919266938070880573235238345",
"211360042034583066576407184200396274745",
"292917114161060296173144304212059980858",
"60503260939705954420693585677802080872",
"298018461312991046913517634245101399641"
]
},
"deprecated": false,
"id": "CVE-2026-34183-55b243af",
"source": "https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac"
},
{
"signature_version": "v1",
"target": {
"function": "depack_do_frame_path_challenge",
"file": "ssl/quic/quic_rx_depack.c"
},
"signature_type": "Function",
"digest": {
"length": 872.0,
"function_hash": "132626122019583303694968741362670635918"
},
"deprecated": false,
"id": "CVE-2026-34183-5755a27a",
"source": "https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac"
},
{
"signature_version": "v1",
"target": {
"file": "include/internal/quic_cfq.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"17619631997647045611390242832180276565",
"133467912692424401758276322394205795573"
]
},
"deprecated": false,
"id": "CVE-2026-34183-5e6198dd",
"source": "https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac"
},
{
"signature_version": "v1",
"target": {
"file": "ssl/quic/quic_channel.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125836126259094406777805326932883223191",
"60821833181468548777893932459539788475",
"296667982168421279828153649100201152846"
]
},
"deprecated": false,
"id": "CVE-2026-34183-67830b3d",
"source": "https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"
},
{
"signature_version": "v1",
"target": {
"file": "include/internal/quic_channel.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"19585554247427260409879349293836484982",
"320207407732071289639035327487100772559",
"199989101668011552648760252046406491392"
]
},
"deprecated": false,
"id": "CVE-2026-34183-68849ef7",
"source": "https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"
},
{
"signature_version": "v1",
"target": {
"file": "ssl/quic/quic_channel_local.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"246818849505342602955063588459453274592",
"142039821623459103211929688998001696677",
"249537960300591757396437299874197582936",
"201112550313325936933021758451806127378",
"312972453870536606714670309149540804956",
"276790711039654102130544296735538223365",
"152010330387736881777572324036182495290",
"211360042034583066576407184200396274745",
"292917114161060296173144304212059980858",
"60503260939705954420693585677802080872",
"298018461312991046913517634245101399641"
]
},
"deprecated": false,
"id": "CVE-2026-34183-792245f2",
"source": "https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517"
},
{
"signature_version": "v1",
"target": {
"function": "depack_do_frame_path_challenge",
"file": "ssl/quic/quic_rx_depack.c"
},
"signature_type": "Function",
"digest": {
"length": 872.0,
"function_hash": "132626122019583303694968741362670635918"
},
"deprecated": false,
"id": "CVE-2026-34183-7f970c96",
"source": "https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"17619631997647045611390242832180276565",
"133467912692424401758276322394205795573"
]
},
"target": {
"file": "include/internal/quic_cfq.h"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-8153717f",
"source": "https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"
},
{
"signature_version": "v1",
"target": {
"file": "ssl/quic/quic_channel_local.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"246818849505342602955063588459453274592",
"142039821623459103211929688998001696677",
"249537960300591757396437299874197582936",
"201112550313325936933021758451806127378",
"312972453870536606714670309149540804956",
"276790711039654102130544296735538223365",
"152010330387736881777572324036182495290",
"211360042034583066576407184200396274745",
"292917114161060296173144304212059980858",
"60503260939705954420693585677802080872",
"298018461312991046913517634245101399641"
]
},
"deprecated": false,
"id": "CVE-2026-34183-8c9b2640",
"source": "https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"
},
{
"signature_version": "v1",
"target": {
"file": "include/internal/quic_channel.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"19585554247427260409879349293836484982",
"320207407732071289639035327487100772559",
"199989101668011552648760252046406491392"
]
},
"deprecated": false,
"id": "CVE-2026-34183-9e3db152",
"source": "https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517"
},
{
"signature_version": "v1",
"target": {
"file": "ssl/quic/quic_txp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"45128711054467000430936538387457324988",
"149330818967290373335056504883011268937",
"165174572031812930150208362394930086547"
]
},
"deprecated": false,
"id": "CVE-2026-34183-a6e57193",
"source": "https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"55439535173121503976817818931592893497",
"127204818329041298298294467612191537359",
"50310224725132401245228365000792676619",
"241198617938439281436044265979510326836"
]
},
"target": {
"file": "ssl/quic/quic_cfq.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-a752837c",
"source": "https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517"
},
{
"digest": {
"length": 720.0,
"function_hash": "336641234594347542091119058144224198347"
},
"target": {
"function": "ossl_quic_handle_frames",
"file": "ssl/quic/quic_rx_depack.c"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-a8cc183a",
"source": "https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"283211022524522070391448529309217208824",
"329079506695569061400663688822238529967",
"259585890385794781954088007576436746201",
"314126815961107843827539235456990714633",
"62503776144225813099440801195654852596",
"320598439248368844790371113406317939478",
"58198862162490549857774812126231871241",
"147707582621090092409827604980361027296",
"181430360261039677944240503697263193139",
"25679097971967302006810284642134833818",
"261014217436443070426393070663901061789",
"195350981400703086860897495539177329907",
"239703671843759910794410441780722913831",
"146320624360984835252900854513445348183",
"136890386920330424456818274815771677790",
"116336189822934654260715916643076962548",
"34705193998360244508034785063793939098",
"314949441320897366462663801149590383427",
"230963046778763378520884607216231961775",
"218992521203189519352461685386097434917",
"254572535331584422775372248106932763356",
"327303269026737496137750226738302406613",
"40892436698869330258788510861527714311",
"265990435268109383772030749012534267652",
"116723079562187072391301754829068613808",
"324820671850974229756945205270737310968",
"221792403960446482882014186362377672968"
]
},
"target": {
"file": "ssl/quic/quic_rx_depack.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-b2ab8e7a",
"source": "https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac"
},
{
"signature_version": "v1",
"target": {
"file": "include/internal/quic_fifd.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"317034173942351296182659702637745233270",
"288307443070895623675948612950410069886"
]
},
"deprecated": false,
"id": "CVE-2026-34183-b48370c0",
"source": "https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac"
},
{
"signature_version": "v1",
"target": {
"function": "ossl_quic_handle_frames",
"file": "ssl/quic/quic_rx_depack.c"
},
"signature_type": "Function",
"digest": {
"length": 720.0,
"function_hash": "336641234594347542091119058144224198347"
},
"deprecated": false,
"id": "CVE-2026-34183-b86bfd02",
"source": "https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"
},
{
"signature_version": "v1",
"target": {
"file": "ssl/quic/quic_rx_depack.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283211022524522070391448529309217208824",
"329079506695569061400663688822238529967",
"259585890385794781954088007576436746201",
"314126815961107843827539235456990714633",
"62503776144225813099440801195654852596",
"320598439248368844790371113406317939478",
"58198862162490549857774812126231871241",
"147707582621090092409827604980361027296",
"181430360261039677944240503697263193139",
"25679097971967302006810284642134833818",
"261014217436443070426393070663901061789",
"195350981400703086860897495539177329907",
"239703671843759910794410441780722913831",
"146320624360984835252900854513445348183",
"136890386920330424456818274815771677790",
"116336189822934654260715916643076962548",
"34705193998360244508034785063793939098",
"314949441320897366462663801149590383427",
"230963046778763378520884607216231961775",
"218992521203189519352461685386097434917",
"254572535331584422775372248106932763356",
"327303269026737496137750226738302406613",
"40892436698869330258788510861527714311",
"307794826365935672971165561225991651499",
"116723079562187072391301754829068613808",
"324820671850974229756945205270737310968",
"221792403960446482882014186362377672968"
]
},
"deprecated": false,
"id": "CVE-2026-34183-ba458a51",
"source": "https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"
},
{
"signature_version": "v1",
"target": {
"function": "depack_do_frame_path_challenge",
"file": "ssl/quic/quic_rx_depack.c"
},
"signature_type": "Function",
"digest": {
"length": 872.0,
"function_hash": "132626122019583303694968741362670635918"
},
"deprecated": false,
"id": "CVE-2026-34183-bcc87eec",
"source": "https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517"
},
{
"signature_version": "v1",
"target": {
"file": "ssl/quic/quic_rx_depack.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283211022524522070391448529309217208824",
"329079506695569061400663688822238529967",
"259585890385794781954088007576436746201",
"314126815961107843827539235456990714633",
"62503776144225813099440801195654852596",
"320598439248368844790371113406317939478",
"58198862162490549857774812126231871241",
"147707582621090092409827604980361027296",
"181430360261039677944240503697263193139",
"25679097971967302006810284642134833818",
"261014217436443070426393070663901061789",
"195350981400703086860897495539177329907",
"239703671843759910794410441780722913831",
"146320624360984835252900854513445348183",
"136890386920330424456818274815771677790",
"116336189822934654260715916643076962548",
"34705193998360244508034785063793939098",
"314949441320897366462663801149590383427",
"230963046778763378520884607216231961775",
"218992521203189519352461685386097434917",
"254572535331584422775372248106932763356",
"327303269026737496137750226738302406613",
"40892436698869330258788510861527714311",
"307794826365935672971165561225991651499",
"116723079562187072391301754829068613808",
"324820671850974229756945205270737310968",
"221792403960446482882014186362377672968"
]
},
"deprecated": false,
"id": "CVE-2026-34183-bf379820",
"source": "https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"
},
{
"signature_version": "v1",
"target": {
"file": "ssl/quic/quic_txp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"45128711054467000430936538387457324988",
"149330818967290373335056504883011268937",
"165174572031812930150208362394930086547"
]
},
"deprecated": false,
"id": "CVE-2026-34183-c60c9c8a",
"source": "https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"102744523836727665300377928872497083301",
"36405000379298267152560283059493923791"
]
},
"target": {
"file": "include/internal/quic_channel.h"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-cc6323aa",
"source": "https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"55439535173121503976817818931592893497",
"127204818329041298298294467612191537359",
"50310224725132401245228365000792676619",
"241198617938439281436044265979510326836"
]
},
"target": {
"file": "ssl/quic/quic_cfq.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-dbc45130",
"source": "https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac"
},
{
"signature_version": "v1",
"target": {
"function": "txp_pkt_commit",
"file": "ssl/quic/quic_txp.c"
},
"signature_type": "Function",
"digest": {
"length": 3008.0,
"function_hash": "161994472543430899723538006510755481804"
},
"deprecated": false,
"id": "CVE-2026-34183-e098c542",
"source": "https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517"
},
{
"signature_version": "v1",
"target": {
"file": "include/internal/quic_fifd.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"317034173942351296182659702637745233270",
"288307443070895623675948612950410069886"
]
},
"deprecated": false,
"id": "CVE-2026-34183-e30a704e",
"source": "https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"45128711054467000430936538387457324988",
"149330818967290373335056504883011268937",
"165174572031812930150208362394930086547"
]
},
"target": {
"file": "ssl/quic/quic_txp.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-e5d033ee",
"source": "https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"
},
{
"signature_version": "v1",
"target": {
"function": "ossl_quic_handle_frames",
"file": "ssl/quic/quic_rx_depack.c"
},
"signature_type": "Function",
"digest": {
"length": 578.0,
"function_hash": "229142732529091447724772618677560281713"
},
"deprecated": false,
"id": "CVE-2026-34183-f0cc7b78",
"source": "https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac"
},
{
"signature_version": "v1",
"target": {
"file": "ssl/quic/quic_rx_depack.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"283211022524522070391448529309217208824",
"329079506695569061400663688822238529967",
"259585890385794781954088007576436746201",
"314126815961107843827539235456990714633",
"62503776144225813099440801195654852596",
"320598439248368844790371113406317939478",
"58198862162490549857774812126231871241",
"147707582621090092409827604980361027296",
"181430360261039677944240503697263193139",
"25679097971967302006810284642134833818",
"261014217436443070426393070663901061789",
"195350981400703086860897495539177329907",
"239703671843759910794410441780722913831",
"146320624360984835252900854513445348183",
"136890386920330424456818274815771677790",
"116336189822934654260715916643076962548",
"34705193998360244508034785063793939098",
"314949441320897366462663801149590383427",
"230963046778763378520884607216231961775",
"218992521203189519352461685386097434917",
"254572535331584422775372248106932763356",
"327303269026737496137750226738302406613",
"40892436698869330258788510861527714311",
"307794826365935672971165561225991651499",
"116723079562187072391301754829068613808",
"324820671850974229756945205270737310968",
"221792403960446482882014186362377672968"
]
},
"deprecated": false,
"id": "CVE-2026-34183-f8b24c3d",
"source": "https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517"
},
{
"signature_version": "v1",
"target": {
"file": "ssl/quic/quic_channel.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"125836126259094406777805326932883223191",
"60821833181468548777893932459539788475",
"296667982168421279828153649100201152846"
]
},
"deprecated": false,
"id": "CVE-2026-34183-fb8378cb",
"source": "https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"246818849505342602955063588459453274592",
"142039821623459103211929688998001696677",
"249537960300591757396437299874197582936",
"201112550313325936933021758451806127378",
"312972453870536606714670309149540804956",
"276790711039654102130544296735538223365",
"152010330387736881777572324036182495290",
"211360042034583066576407184200396274745",
"292917114161060296173144304212059980858",
"60503260939705954420693585677802080872",
"298018461312991046913517634245101399641"
]
},
"target": {
"file": "ssl/quic/quic_channel_local.h"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-fba742e1",
"source": "https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"
},
{
"digest": {
"length": 3008.0,
"function_hash": "161994472543430899723538006510755481804"
},
"target": {
"function": "txp_pkt_commit",
"file": "ssl/quic/quic_txp.c"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-34183-fe66950c",
"source": "https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"
}
]
vanir_signatures_modified
"2026-07-11T13:18:18Z"
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-34183.json"