CVE-2026-42772: Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC
Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data.
Other sources
Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 3.0.20-1~deb12u2Fixed in 3.0.22-1~deb12u1Fixed in 3.5.7-1~deb13u3Fixed in 3.6.5-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.7-7
Event History
Frequently Asked Questions
What does an attacker need to do to trigger the CPU pressure?
The attacker must act as a remote QUIC peer and complete the QUIC handshake. They can then send compliant STREAM frames with manipulated out-of-order offsets within the advertised receive window; malformed frames are not required.
Is the OpenSSL FIPS module affected?
No. The QUIC implementation is outside the OpenSSL FIPS module boundary, so the FIPS module is not affected.