UBUNTU-CVE-2026-88822: Medium severity ubuntu/openssl vulnerability
Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is then used as the destination for outgoing packets. Impact summary: Applications using QUIC's automated peer detection mechanism may receive an invalid address, leading to connection loss and disclosure of uninitialized stack data to an attacker observing the outgoing network traffic. CWE: CWE-457 (Use of Uninitialized Variable) Description: The OpenSSL QUIC stack contains a feature in which, when using an already connected socket, it will auto-detect the peer address during the SSL handshake. This feature uses the getpeername() function, passing a buffer of sufficient length to hold any supported address family, but passes a buffer length that is only sized such that larger addresses, such as IPv6, cannot be retrieved. The getpeername() function however, still returns the full address length, which is accepted as the valid input buffer length, leading to the address buffer containing uninitialized stack data instead of the actual peer address. The invalid peer address is then used as destination for the outgoing packets which leads to a connectivity breakage and a leakage of the uninitialized stack data to passive network observers. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected protocol is not implemented in the FIPS module.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using the OpenSSL QUIC stack with an already connected socket and QUIC automated peer detection during the SSL handshake are affected. The issue is associated with Ubuntu packages including openssl, openssl-fips, openssl1.0, nodejs, edk2, and edk2-hwe.
What conditions are required for exploitation?
The vulnerable path requires QUIC automated peer detection on an already connected socket. An attacker must be able to observe outgoing network traffic to receive any uninitialized stack data leaked through packets sent to the invalid destination address.
What is the operational impact if the vulnerable path is reached?
The application can obtain an invalid peer address and use it as the destination for outgoing packets, causing connection loss. Those packets may also disclose uninitialized stack data to an observer of the outgoing traffic.