Allocation of Resources Without Limits or Throttling in OpenSSL - CVE-2026-14456

Vulnerability identifier: #VU143573

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-14456

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the QUIC server incoming channel queue when processing valid QUIC Initial packets for unknown destination connection IDs. A remote attacker can send many QUIC Initial packets faster than the application accepts connections to cause a denial of service.

The issue affects the Listener SSL object in the QUIC server implementation and can make the QUIC listener unavailable if pending connections accumulate.

OpenSSL
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Basesystem Module
Ubuntu
openEuler
openssl (Ubuntu package)
libopenssl3
libopenssl-3-fips-provider-32bit-debuginfo
libopenssl3-32bit-debuginfo
libopenssl3-32bit
libopenssl-3-fips-provider-32bit
libopenssl-3-fips-provider
libopenssl-3-devel
libopenssl3-debuginfo
openssl-3-debugsource
libopenssl-3-fips-provider-debuginfo
openssl-3
openssl-3-debuginfo
openssl-help
openssl-perl
openssl-libs
openssl-devel
openssl-debugsource
openssl-debuginfo
openssl
openssl (Debian package)

Install update from vendor's website.

OpenSSL - addressed in versions 3.5.8, 3.6.4, 4.0.2
openssl (Ubuntu package) - addressed in versions 3.0.2-0ubuntu1.29, 3.0.13-0ubuntu3.15, 3.5.5-1ubuntu3.4, 3.5.5-1ubuntu3.5
libopenssl3 - update to 3.5.0-150700.5.50.1
libopenssl-3-fips-provider-32bit-debuginfo - update to 3.5.0-150700.5.50.1
libopenssl3-32bit-debuginfo - update to 3.5.0-150700.5.50.1
libopenssl3-32bit - update to 3.5.0-150700.5.50.1
libopenssl-3-fips-provider-32bit - update to 3.5.0-150700.5.50.1
libopenssl-3-fips-provider - update to 3.5.0-150700.5.50.1
libopenssl-3-devel - update to 3.5.0-150700.5.50.1
libopenssl3-debuginfo - update to 3.5.0-150700.5.50.1
openssl-3-debugsource - update to 3.5.0-150700.5.50.1
libopenssl-3-fips-provider-debuginfo - update to 3.5.0-150700.5.50.1
openssl-3 - update to 3.5.0-150700.5.50.1
openssl-3-debuginfo - update to 3.5.0-150700.5.50.1
openssl-help - update to 3.5.6-5
openssl-perl - update to 3.5.6-5
openssl-libs - update to 3.5.6-5
openssl-devel - update to 3.5.6-5
openssl-debugsource - update to 3.5.6-5
openssl-debuginfo - update to 3.5.6-5
openssl - update to 3.5.6-5
openssl (Debian package) - update to 3.5.7-1~deb13u2

• https://openssl-library.org/news/secadv/20260813.txt

• Two vulnerabilities in OpenSSL
• Debian update for openssl
• Ubuntu update for openssl
• openEuler 24.03 LTS SP4 update for openssl
• Ubuntu update for openssl
• SUSE update for openssl-3