Allocation of Resources Without Limits or Throttling in OpenSSL - CVE-2026-63075

Vulnerability identifier: #VU145423

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-63075

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the OpenSSL QUIC stack when retaining ACK-only packet metadata during connection processing. A remote user can establish a QUIC connection, send numerous PING frames, and withhold acknowledgements to cause a denial of service.

Exploitation requires the peer to complete a QUIC handshake, and the memory growth is scoped to the lifetime of the connection.

OpenSSL
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
FreeBSD
Basesystem Module
Ubuntu
openEuler
openssl (Ubuntu package)
libopenssl-3-fips-provider-32bit-debuginfo
libopenssl3-32bit-debuginfo
libopenssl3
openssl-3-debuginfo
openssl-3
libopenssl-3-fips-provider-debuginfo
openssl-3-debugsource
libopenssl3-debuginfo
libopenssl-3-devel
libopenssl-3-fips-provider
libopenssl-3-fips-provider-32bit
libopenssl3-32bit
openssl
openssl-debuginfo
openssl-debugsource
openssl-devel
openssl-libs
openssl-perl
openssl-help
openssl (Debian package)

Install security update from vendor's website.

OpenSSL - addressed in versions 3.4.7, 3.5.8, 3.6.4, 4.0.2
openssl (Ubuntu package) - addressed in versions 3.0.2-0ubuntu1.29, 3.0.13-0ubuntu3.15, 3.5.5-1ubuntu3.4, 3.5.5-1ubuntu3.5
libopenssl-3-fips-provider-32bit-debuginfo - update to 3.5.0-150700.5.50.1
libopenssl3-32bit-debuginfo - update to 3.5.0-150700.5.50.1
libopenssl3 - update to 3.5.0-150700.5.50.1
openssl-3-debuginfo - update to 3.5.0-150700.5.50.1
openssl-3 - update to 3.5.0-150700.5.50.1
libopenssl-3-fips-provider-debuginfo - update to 3.5.0-150700.5.50.1
openssl-3-debugsource - update to 3.5.0-150700.5.50.1
libopenssl3-debuginfo - update to 3.5.0-150700.5.50.1
libopenssl-3-devel - update to 3.5.0-150700.5.50.1
libopenssl-3-fips-provider - update to 3.5.0-150700.5.50.1
libopenssl-3-fips-provider-32bit - update to 3.5.0-150700.5.50.1
libopenssl3-32bit - update to 3.5.0-150700.5.50.1
openssl - update to 3.5.6-7
openssl-debuginfo - update to 3.5.6-7
openssl-debugsource - update to 3.5.6-7
openssl-devel - update to 3.5.6-7
openssl-libs - update to 3.5.6-7
openssl-perl - update to 3.5.6-7
openssl-help - update to 3.5.6-7
openssl (Debian package) - update to 3.5.7-1~deb13u2

• https://openssl-library.org/news/secadv/20260825.txt

• Multiple vulnerabilities in OpenSSL
• Debian update for openssl
• FreeBSD update for OpenSSL
• Ubuntu update for openssl
• Ubuntu update for openssl
• SUSE update for openssl-3
• openEuler 24.03 LTS SP4 update for openssl