https://seclists.org/oss-sec/2026/q3/571: OpenSSL Security Advisory [25th August 2026]
Published Aug 25, 2026
·Updated
Affected Software
7 affected components
OpenSSL OpenSSL 4.0<=4.0.1
OpenSSL OpenSSL 3.6<=3.6.3
OpenSSL OpenSSL 3.5<=3.5.7
OpenSSL OpenSSL 3.0<=3.0.21
OpenSSL OpenSSL 1.1.1<=1.1.1y
OpenSSL OpenSSL 1.0.2<=1.0.2q
OpenSSL OpenSSL 3.4<=3.4.6
Frequently Asked Questions
1
Which deployments are exposed to this issue?
OpenSSL deployments operating as QUIC servers are exposed. The affected path is the QUIC stack's default packet handler while processing an INITIAL packet.
2
What conditions are required to trigger the fault?
An INITIAL packet must validate successfully, and creation of the associated channel or connection object must then fail. In that failure path, the QRX object can be freed twice.
3
What is the expected impact of exploitation?
The double free can corrupt the heap and typically terminates the QUIC server process, causing denial of service. There is no evidence that remote code execution is possible, and it is considered highly improbable.