CVE-2026-63075: QUIC ACK-only Packet Retention Can Cause Memory Exhaustion
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1w-0+deb11u8Fixed in 3.0.20-1~deb12u2
Event History
Frequently Asked Questions
Which deployments are exposed?
The issue applies to deployments using the OpenSSL QUIC stack and processing QUIC traffic. The available data does not identify affected versions or configuration defaults.
What does an attacker need to do to trigger the condition?
The attacker must be able to complete a QUIC handshake. They can then repeatedly send ack-eliciting packets, such as PING frames, while withholding acknowledgements for subsequent ack-eliciting traffic.
How does the resource impact scale?
Memory growth is scoped to each affected connection because ACK-only packet metadata can remain retained for that connection's lifetime. Sustained traffic or many concurrent malicious QUIC connections can increase the likelihood of memory exhaustion and denial of service.