Allocation of Resources Without Limits or Throttling in OpenSSL - CVE-2026-14456
Published: August 16, 2026
Vulnerability identifier: #VU143573
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-14456
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the QUIC server incoming channel queue when processing valid QUIC Initial packets for unknown destination connection IDs. A remote attacker can send many QUIC Initial packets faster than the application accepts connections to cause a denial of service.
The issue affects the Listener SSL object in the QUIC server implementation and can make the QUIC listener unavailable if pending connections accumulate.
Affected software
OpenSSL
How to mitigate CVE-2026-14456
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.