CVE-2026-18798: QUIC Server May Trigger Double Free When Processing INITIAL Packet
Published Aug 25, 2026
·Updated
Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet.
Affected Software
2 affected componentsFixes available
OpenSSL OpenSSL QUIC (default packet handler)
debian/openssl<=3.5.6-1~deb13u2, <=3.6.3-1
1.1.1w-0+deb11u11.1.1w-0+deb11u83.0.20-1~deb12u2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1w-0+deb11u8Fixed in 3.0.20-1~deb12u2
Event History
Aug 25, 2026
CVE Published
via MITRE·12:59 PM
Data Sourced
via MITRE·12:59 PM
DescriptionWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Data Sourced
via Ubuntu·07:09 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·07:11 PM
Description
Data Sourced
via Debian·07:11 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the practical impact of successful exploitation?
The double free can corrupt heap memory and typically terminates the QUIC server process, causing a denial of service. There is currently no evidence of remote code execution, and it is considered highly improbable.
2
What must an attacker do to trigger the issue?
An attacker needs to send an INITIAL QUIC packet that passes initial validation but causes channel creation in port_bind_channel() to fail. The available information states that this failure can be induced with relatively low effort using malformed input.