CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

Published May 27, 2026
·
Updated

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATHCHALLENGE frames.

Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local QUIC stack with PATHCHALLENGE frames. The local QUIC stack allocates a PATHRESPONSE frame for every PATHCHALLENGE it receives. The allocated PATHRESPONSE frame gets freed only when the remote peer acknowledges reception of the PATHRESPONSE frame which will not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Other sources

Unbounded Memory Growth in the QUIC PATHCHALLENGE Handler

— Microsoft

Affected Software

6 affected componentsFixes available
OpenSSL OpenSSL>=3.4.0<3.4.6, >=3.5.0<3.5.7, >=3.6.0<3.6.3, >=4.0.0<4.0.1
OpenSSL OpenSSL>=3.4.0<3.4.6
OpenSSL OpenSSL>=3.5.0<3.5.7
OpenSSL OpenSSL>=3.6.0<3.6.3
OpenSSL OpenSSL=4.0.0
Microsoft azl3 openssl 3.3.5-5<3.3.7-3
3.3.7-3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.3.7-3
  2. Upgrade

    Upgrade OpenSSL to a version that resolves this vulnerability.

    Fixed in 3.4.6
  3. Upgrade

    Upgrade OpenSSL to a version that resolves this vulnerability.

    Fixed in 3.5.7
  4. Upgrade

    Upgrade OpenSSL to a version that resolves this vulnerability.

    Fixed in 3.6.3
  5. Upgrade

    Upgrade OpenSSL to a version that resolves this vulnerability.

    Fixed in 4.0.1
  6. Compensating control

    Mitigate the QUIC heap exhaustion by preventing untrusted remote peers from flooding the local QUIC stack with packets containing PATH_CHALLENGE frames (e.g., apply network filtering/rate-limiting/ACLs so only trusted peers can send QUIC PATH_CHALLENGE traffic).

Event History

May 27, 2026
Data Sourced
via Red Hat·02:05 PM
DescriptionSeverityAffected Software
Jun 9, 2026
CVE Published
via MITRE·04:03 PM
Data Sourced
via MITRE·04:03 PM
DescriptionWeakness
Data Sourced
via NVD·05:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jun 13, 2026
Data Sourced
via Microsoft·08:02 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:02 AM
Affected Software
Updated
via Microsoft·08:02 AM
DescriptionSeverity

Frequently Asked Questions

1

What is the severity of CVE-2026-34183?

The severity of CVE-2026-34183 is rated high with a CVSS score of 7.5.

2

What does CVE-2026-34183 affect?

CVE-2026-34183 affects implementations of QUIC in OpenSSL.

3

How do I fix CVE-2026-34183?

To fix CVE-2026-34183, update to the latest version of OpenSSL that includes the patch for this vulnerability.

4

What type of attack does CVE-2026-34183 describe?

CVE-2026-34183 describes a denial-of-service attack that can lead to unbounded memory growth and application termination.

5

Who is impacted by CVE-2026-34183?

Users operating QUIC servers or clients that utilize OpenSSL may be impacted by CVE-2026-34183.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203