CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits.
Other sources
QUIC Connection-Level Flow Control is Not Enforced for Streams
— Debian
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 3.0.20-1~deb12u2Fixed in 3.0.22-1~deb12u1
Event History
Frequently Asked Questions
What does an attacker need to do to trigger the excessive memory use?
The attacker must be a remote QUIC peer that opens several streams and sends data on each stream without exceeding that stream's individual flow-control limit. The aggregate data across streams can exceed the connection-level limit because that limit is not enforced.
How much memory can this consume under the described default flow-control settings?
A malicious peer may cause the QUIC stack to receive approximately 100 MB of memory rather than the 768 KiB default flow-control window size.