CVE-2026-14456: Unbounded Memory Growth in QUIC Server Incoming Channel Queue
Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit.
Other sources
Unbounded Memory Growth in QUIC Server Incoming Channel Queue
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 3.5.7-1~deb13u2Fixed in 3.6.4-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14456?
The severity of CVE-2026-14456 is rated at 36, indicating a significant risk of unbounded memory growth.
How do I fix CVE-2026-14456?
To fix CVE-2026-14456, you should update your OpenSSL to the latest version that addresses the vulnerability.
What systems are affected by CVE-2026-14456?
CVE-2026-14456 affects OpenSSL QUIC servers that process valid QUIC Initial packets with unknown destination connection IDs.
What is the impact of CVE-2026-14456?
The impact of CVE-2026-14456 is that a remote peer can potentially cause unbounded memory allocation leading to denial of service.
Is CVE-2026-14456 exploitable remotely?
Yes, CVE-2026-14456 is exploitable remotely by sending numerous valid QUIC Initial packets to the affected server.