CVE-2026-63075

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63075
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-63075.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-63075
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CGA (14)
DEBIAN (1)
MGASA (1)
MINI (1)
OESA (1)
openSUSE (2)
RHSA (4)
RLSA (2)
SUSE (2)
UBUNTU (1)
Related
ALSA (2)
openSUSE (2)
SUSE (2)
Published
2026-08-25T13:00:04Z
Modified
2026-09-16T08:18:05Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
QUIC ACK-only Packet Retention Can Cause Memory Exhaustion
Details

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection.

Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections.

CWE: CWE-770: Allocation of Resources Without Limits or Throttling

Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service.

The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself.

FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.

Database specific 
{
    "cna_assigner":  "openssl",
    "cwe_ids":  [
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63075.json"
}
References

Affected packages

Git / github.com/openssl/openssl

Affected ranges

Type
GIT
Repo
https://github.com/openssl/openssl
Events
Introduced
98acb6b02839c609ef5b837794e08d906d965335
Fixed
0c5d912057abf47505b4ad455da49fbab99b76f1
Introduced
636dfadc70ce26f2473870570bfd9ec352806b1d
Fixed
f4dc4d58b48d346a8270183f89acf826d459b0ca
Introduced
7b371d80d959ec9ab4139d09d78e83c090de9779
Fixed
d3c1b1169b3569ff3069e5b399f47b2b28e03d79
Introduced
11b7b6ea3b65a584e1d31408ed1bdb139465cffd
Fixed
f089acdf4bc7ba94a79f4bf6eb7362c3e7d14aa9
Fixed
7308946576b12e64b8be53bcf0a120354b2b42bc
Fixed
7c98d79738549df92868e7dd9be4bbf061eed709
Fixed
bf84721c2548351176e367e6de505792f0118dc6
Fixed
c902e5f16d6a9e130e96d3ca6d8f64d71652e393
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "3.4.0"
        },
        {
            "fixed":  "3.4.7"
        },
        {
            "introduced":  "3.5.0"
        },
        {
            "fixed":  "3.5.8"
        },
        {
            "introduced":  "3.6.0"
        },
        {
            "fixed":  "3.6.4"
        },
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.0.2"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.4-POST-CLANG-FORMAT-WEBKIT
3.4-PRE-CLANG-FORMAT-WEBKIT
3.5-POST-CLANG-FORMAT-WEBKIT
3.5-PRE-CLANG-FORMAT-WEBKIT
3.6-POST-CLANG-FORMAT-WEBKIT
3.6-PRE-CLANG-FORMAT-WEBKIT
openssl-3.*
openssl-3.4.0
openssl-3.4.1
openssl-3.4.2
openssl-3.4.3
openssl-3.4.4
openssl-3.4.5
openssl-3.4.6
openssl-3.5.0
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
openssl-3.5.4
openssl-3.5.5
openssl-3.5.6
openssl-3.5.7
openssl-3.6.0
openssl-3.6.1
openssl-3.6.2
openssl-3.6.3
openssl-4.*
openssl-4.0.0
openssl-4.0.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-63075.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "127710184027588375730281123550413388352",
                "238778791714889156187923495759454262098",
                "43228413521986251441327542187044196294",
                "157165095343400443831817287366539372303",
                "208025372272675792743080770736216211694",
                "98469575915396588714434502354077940640",
                "321030774570816453328135141838369112950",
                "119348148652855593112668749738808551759",
                "29246340682027729734788744750284149293",
                "165708783685566916073259555845909499086",
                "194278137406181817761257540485452556920",
                "303357429146340544327831805381917788599",
                "335729294147678692579504856436129565902",
                "217456826098717150031667494494832190521",
                "312756047032349463284920395476681698635",
                "140658052204989063335153801270892005020"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63075-0d25529b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/7c98d79738549df92868e7dd9be4bbf061eed709",
        "target":  {
            "file":  "ssl/quic/quic_txp.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "127710184027588375730281123550413388352",
                "238778791714889156187923495759454262098",
                "43228413521986251441327542187044196294",
                "157165095343400443831817287366539372303",
                "208025372272675792743080770736216211694",
                "98469575915396588714434502354077940640",
                "321030774570816453328135141838369112950",
                "119348148652855593112668749738808551759",
                "29246340682027729734788744750284149293",
                "165708783685566916073259555845909499086",
                "194278137406181817761257540485452556920",
                "303357429146340544327831805381917788599",
                "335729294147678692579504856436129565902",
                "217456826098717150031667494494832190521",
                "312756047032349463284920395476681698635",
                "140658052204989063335153801270892005020"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63075-135e1c69",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393",
        "target":  {
            "file":  "ssl/quic/quic_txp.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "93235371864493199705931916959879974733",
                "40152205282306838120683427168311731088",
                "267133881629038346258451224701791507362"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63075-16ee1744",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/7c98d79738549df92868e7dd9be4bbf061eed709",
        "target":  {
            "file":  "ssl/quic/quic_ackm.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "93235371864493199705931916959879974733",
                "40152205282306838120683427168311731088",
                "267133881629038346258451224701791507362"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63075-1b91492a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393",
        "target":  {
            "file":  "ssl/quic/quic_ackm.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "93235371864493199705931916959879974733",
                "40152205282306838120683427168311731088",
                "267133881629038346258451224701791507362"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63075-2b83b044",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/bf84721c2548351176e367e6de505792f0118dc6",
        "target":  {
            "file":  "ssl/quic/quic_ackm.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "334889624218050444897162493738252543537",
            "length":  3045
        },
        "id":  "CVE-2026-63075-40ca9834",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/7c98d79738549df92868e7dd9be4bbf061eed709",
        "target":  {
            "file":  "ssl/quic/quic_txp.c",
            "function":  "txp_pkt_commit"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "334889624218050444897162493738252543537",
            "length":  3045
        },
        "id":  "CVE-2026-63075-5bf507d6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/bf84721c2548351176e367e6de505792f0118dc6",
        "target":  {
            "file":  "ssl/quic/quic_txp.c",
            "function":  "txp_pkt_commit"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "223628302570180496787923061552132365924",
                "7216203165409807613722880547111416421",
                "323933867113046269660754449308397129751",
                "72452435522323432164760031484709852745"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63075-7101f9d9",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/7308946576b12e64b8be53bcf0a120354b2b42bc",
        "target":  {
            "file":  "include/internal/quic_ackm.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "223628302570180496787923061552132365924",
                "7216203165409807613722880547111416421",
                "323933867113046269660754449308397129751",
                "72452435522323432164760031484709852745"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63075-7f23ffeb",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/7c98d79738549df92868e7dd9be4bbf061eed709",
        "target":  {
            "file":  "include/internal/quic_ackm.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "127710184027588375730281123550413388352",
                "238778791714889156187923495759454262098",
                "43228413521986251441327542187044196294",
                "157165095343400443831817287366539372303",
                "208025372272675792743080770736216211694",
                "98469575915396588714434502354077940640",
                "321030774570816453328135141838369112950",
                "119348148652855593112668749738808551759",
                "29246340682027729734788744750284149293",
                "165708783685566916073259555845909499086",
                "194278137406181817761257540485452556920",
                "303357429146340544327831805381917788599",
                "335729294147678692579504856436129565902",
                "217456826098717150031667494494832190521",
                "312756047032349463284920395476681698635",
                "140658052204989063335153801270892005020"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63075-944a2019",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/7308946576b12e64b8be53bcf0a120354b2b42bc",
        "target":  {
            "file":  "ssl/quic/quic_txp.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "127710184027588375730281123550413388352",
                "238778791714889156187923495759454262098",
                "43228413521986251441327542187044196294",
                "157165095343400443831817287366539372303",
                "208025372272675792743080770736216211694",
                "98469575915396588714434502354077940640",
                "321030774570816453328135141838369112950",
                "119348148652855593112668749738808551759",
                "29246340682027729734788744750284149293",
                "165708783685566916073259555845909499086",
                "194278137406181817761257540485452556920",
                "303357429146340544327831805381917788599",
                "335729294147678692579504856436129565902",
                "217456826098717150031667494494832190521",
                "312756047032349463284920395476681698635",
                "140658052204989063335153801270892005020"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63075-b000da0b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/bf84721c2548351176e367e6de505792f0118dc6",
        "target":  {
            "file":  "ssl/quic/quic_txp.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "223628302570180496787923061552132365924",
                "7216203165409807613722880547111416421",
                "323933867113046269660754449308397129751",
                "72452435522323432164760031484709852745"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63075-df24f473",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/bf84721c2548351176e367e6de505792f0118dc6",
        "target":  {
            "file":  "include/internal/quic_ackm.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "223628302570180496787923061552132365924",
                "7216203165409807613722880547111416421",
                "323933867113046269660754449308397129751",
                "72452435522323432164760031484709852745"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63075-e57c3870",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393",
        "target":  {
            "file":  "include/internal/quic_ackm.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "334889624218050444897162493738252543537",
            "length":  3045
        },
        "id":  "CVE-2026-63075-e7b11841",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/7308946576b12e64b8be53bcf0a120354b2b42bc",
        "target":  {
            "file":  "ssl/quic/quic_txp.c",
            "function":  "txp_pkt_commit"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "334889624218050444897162493738252543537",
            "length":  3045
        },
        "id":  "CVE-2026-63075-e9f34370",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393",
        "target":  {
            "file":  "ssl/quic/quic_txp.c",
            "function":  "txp_pkt_commit"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "93235371864493199705931916959879974733",
                "40152205282306838120683427168311731088",
                "267133881629038346258451224701791507362"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63075-f3aecda8",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/7308946576b12e64b8be53bcf0a120354b2b42bc",
        "target":  {
            "file":  "ssl/quic/quic_ackm.c"
        }
    }
]
vanir_signatures_modified 
"2026-09-16T08:18:05Z"