CVE-2026-18798: QUIC Server May Trigger Double Free When Processing INITIAL Packet
Published Aug 25, 2026
·Updated
Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet.
Affected Software
5 affected componentsFixes available
OpenSSL OpenSSL QUIC (default packet handler)
debian/openssl<=3.5.6-1~deb13u2, <=3.6.3-1
1.1.1w-0+deb11u11.1.1w-0+deb11u83.0.20-1~deb12u23.5.7-1~deb13u23.6.4-1
OpenSSL OpenSSL>=3.5.0<3.5.8
OpenSSL OpenSSL>=3.6.0<3.6.4
OpenSSL OpenSSL>=4.0.0<4.0.2
Remediation
Event History
Aug 25, 2026
CVE Published
via MITRE·12:59 PM
Data Sourced
via MITRE·12:59 PM
DescriptionWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
RemedyAffected Software
Data Sourced
via Launchpad·07:11 PM
Description
Aug 26, 2026
Data Sourced
via Ubuntu·07:10 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·07:12 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the practical impact of successful exploitation?
The double free can corrupt heap memory and typically terminates the QUIC server process, causing a denial of service. There is currently no evidence of remote code execution, and it is considered highly improbable.
2
What must an attacker do to trigger the issue?
An attacker needs to send an INITIAL QUIC packet that passes initial validation but causes channel creation in port_bind_channel() to fail. The available information states that this failure can be induced with relatively low effort using malformed input.