CVE-2026-63075: QUIC ACK-only Packet Retention Can Cause Memory Exhaustion
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection.
Other sources
QUIC ACK-only Packet Retention Can Cause Memory Exhaustion
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1w-0+deb11u8Fixed in 3.0.20-1~deb12u2Fixed in 3.5.7-1~deb13u2Fixed in 3.6.4-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.3.7-6 - Configuration
Apply the described fix: ensure that transmission of QUIC ACK-only packets is accounted for in the packet histories high and low watermark, without actually storing ACK-only packet metadata itself.
OpenSSL QUIC ACK-only handling packet histories high/low watermark = Account for ACK-only packet transmission without storing ACK-only packet metadata - Compensating control
Mitigate the described DoS by reducing exposure to malicious peers that can repeatedly trigger ACK-only packet retention (e.g., rate-limit or otherwise throttle QUIC PING/ack-eliciting traffic, and/or limit concurrent QUIC connections per client) until the OpenSSL QUIC fix is deployed.
Event History
Frequently Asked Questions
Which deployments are exposed?
The issue applies to deployments using the OpenSSL QUIC stack and processing QUIC traffic. The available data does not identify affected versions or configuration defaults.
What does an attacker need to do to trigger the condition?
The attacker must be able to complete a QUIC handshake. They can then repeatedly send ack-eliciting packets, such as PING frames, while withholding acknowledgements for subsequent ack-eliciting traffic.
How does the resource impact scale?
Memory growth is scoped to each affected connection because ACK-only packet metadata can remain retained for that connection's lifetime. Sustained traffic or many concurrent malicious QUIC connections can increase the likelihood of memory exhaustion and denial of service.