CVE-2026-54873: QUIC STREAM Fragment Metadata DoS
Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 3.0.20-1~deb12u2Fixed in 3.0.22-1~deb12u1Fixed in 3.5.7-1~deb13u3Fixed in 3.6.5-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.7-7
Event History
Frequently Asked Questions
What does an attacker need in order to trigger the memory retention?
The attacker must act as a remote QUIC peer and send maliciously crafted packets. The issue occurs when stream data remains in packet buffers while the stack waits for the local receiving application to provide a buffer for copying that data.
Can the attacker influence how long memory remains allocated?
Yes. The period for which packet-buffer memory remains allocated is entirely under the control of the potentially malicious remote peer, allowing retained memory to accumulate.
What changes in the mitigation?
The mitigated QUIC stack calculates and monitors memory overhead for every stream. This addresses the excess memory retained when packet buffers are kept referenced for stream data awaiting delivery to the local application.