OpenSSL QUIC Stack Memory Allocation Vulnerability - CVE-2026-75804
Summary
ALPINE-CVE-2026-75804: Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Affects openssl versions < 3.3.7-r2. Fixed in 3.3.7-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely-used open-source implementation of the SSL and TLS protocols, providing cryptographic functions for secure communication over networks. The QUIC stack in OpenSSL facilitates low-latency connections and is designed to improve performance in web applications. However, it has been found to have a vulnerability related to flow control limits, which can lead to excessive memory allocation.
Vulnerability Detail
The vulnerability arises from the OpenSSL QUIC stack's failure to enforce connection-level flow control for streams. While it correctly limits stream-level flow control, it does not impose the same restrictions at the connection level. This oversight allows a malicious remote peer to exploit the system by opening multiple streams and sending data that exceeds the intended memory allocation limits. As a result, the QUIC stack can be forced to allocate up to 100MB of memory per connection, leading to potential denial of service and resource exhaustion.
How To Fix
Minimum fixed version
3.3.7-r2
This is the first release that contains the fix.
sudo apk add --upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2026-75804 represents a significant vulnerability in the OpenSSL QUIC stack, allowing for potential memory exhaustion through improper flow control enforcement. It is essential for users to update to the patched version to mitigate risks associated with this vulnerability.
See every vulnerability recorded for openssl →
FAQ
CVE-2026-75804 is a vulnerability in the OpenSSL QUIC stack that allows remote peers to bypass connection-level flow control limits, potentially leading to excessive memory allocation.
If your application uses OpenSSL with the vulnerable QUIC stack, it may be susceptible to denial of service attacks due to excessive memory usage, which can degrade performance or crash the application.
While there are no specific workarounds, it is crucial to monitor your application for unusual memory usage and plan to update to the patched version as soon as possible.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without requiring code access.
The CVSS score for CVE-2026-75804 is 5.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
