{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14456", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "state": "PUBLISHED", "assignerShortName": "openssl", "dateReserved": "2026-07-02T08:35:57.518Z", "datePublished": "2026-08-13T13:55:52.370Z", "dateUpdated": "2026-08-13T17:41:29.420Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.0.2", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.4", "status": "affected", "version": "3.6.0", "versionType": "semver"}, {"lessThan": "3.5.8", "status": "affected", "version": "3.5.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Filipe Casal (Trail of Bits)"}, {"lang": "en", "type": "remediation developer", "value": "Alexandr Nedvedicky"}], "datePublic": "2026-08-13T07:00:13.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes<br>valid QUIC Initial packets for unknown destination connection IDs, it<br>can allocate and queue new incoming channels without enforcing any limit.<br><br>Impact summary: A remote peer that can make many Initial packets reach the<br>server listener faster than the application accepts connections, can cause the<br>memory allocated to store the per-channel state to grow without any limits,<br>potentially making the QUIC listener unavailable and causing Denial of Service.<br><br>CWE: CWE-770: Allocation of Resources Without Limits or Throttling<br><br>Description: The function that handles inbound QUIC packets uses<br>Connection-Id from the packet header to find an existing connection<br>(QUIC channel). If no existing connection is found and the packet<br>type is INITIAL, the function treats the packet as a new connection. It<br>allocates a new channel object and inserts it into a queue where it<br>waits to be accepted by the local application with SSL_accept(3ossl).<br>The memory occupied by these initial channel objects may grow<br>without bounds if the application is not able to call SSL_accept()<br>frequently enough to serve these inbound connection requests.<br><br>The issue is present since OpenSSL 3.5 when the QUIC server implementation<br>was added.<br><br>The fix introduces a limit for pending connections. The default limit is set<br>to 256 pending connections (waiting to be accepted by the local application).<br>Applications may change the default by calling SSL_set_value_uint(3ossl).<br><br>FIPS impact: no<br>The FIPS module is not affected as the QUIC implementation is outside of<br>the OpenSSL FIPS module boundary."}], "value": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}], "metrics": [{"format": "other", "other": {"content": {"text": "Low"}, "type": "https://openssl-library.org/policies/general/security-policy/"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-08-13T13:55:52.370Z"}, "references": [{"name": "OpenSSL Advisory", "tags": ["vendor-advisory"], "url": "https://openssl-library.org/news/secadv/20260813.txt"}, {"name": "4.0 branch git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139"}, {"name": "3.6 branch git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b"}, {"name": "3.5 branch git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9"}], "source": {"discovery": "UNKNOWN"}, "title": "Unbounded Memory Growth in QUIC Server Incoming Channel Queue", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/13/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-13T16:18:19.434Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T17:41:23.819585Z", "id": "CVE-2026-14456", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T17:41:29.420Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.0.2", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.4", "status": "affected", "version": "3.6.0", "versionType": "semver"}, {"lessThan": "3.5.8", "status": "affected", "version": "3.5.0", "versionType": "semver"}]}], "source": "openssl-security@openssl.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}], "id": "CVE-2026-14456", "lastModified": "2026-08-13T17:17:20.227", "metrics": {}, "published": "2026-08-13T15:19:31.820", "references": [{"source": "openssl-security@openssl.org", "url": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9"}, {"source": "openssl-security@openssl.org", "url": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b"}, {"source": "openssl-security@openssl.org", "url": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139"}, {"source": "openssl-security@openssl.org", "url": "https://openssl-library.org/news/secadv/20260813.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/08/13/4"}], "sourceIdentifier": "openssl-security@openssl.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "openssl-security@openssl.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.6.0,3.6.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.5.0,3.5.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OpenSSL", "source": "cna", "vendor": "OpenSSL"}, "product": "openssl", "vendor": "openssl"}], "created": "2026-08-13T15:30:04.385706+00:00", "updated": "2026-08-13T15:45:03.698833+00:00", "vendors": ["openssl", "openssl$PRODUCT$openssl"]}