CVE-2026-18798: QUIC Server May Trigger Double Free When Processing INITIAL Packet

A flaw was found in OpenSSL. QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable.

In order to validate initial packet, OpenSSL QUIC stack default packet handler (portdefaultpackethandler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to portbindchannel(), so it becomes part of the newly created connection. If portbindchannel() fails, then it also frees the QRX object. Once portbindchannel() returns, the portdefaultpackethandler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time.

The failure in portbindchannel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then portbindchannel() jumps to the error path after osslquiclcidmenrolodcid() detects that the DCID has invalid length.

The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.

OpenSSL 4.0, 3.6, and 3.5 are vulnerable to this issue. OpenSSL 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.