Allocation of Resources Without Limits or Throttling in OpenSSL - CVE-2026-63075
Published: August 26, 2026
Vulnerability identifier: #VU145423
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63075
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the OpenSSL QUIC stack when retaining ACK-only packet metadata during connection processing. A remote user can establish a QUIC connection, send numerous PING frames, and withhold acknowledgements to cause a denial of service.
Exploitation requires the peer to complete a QUIC handshake, and the memory growth is scoped to the lifetime of the connection.
Affected software
OpenSSL
Debian Linux
FreeBSD
openssl (Debian package)
Debian Linux
FreeBSD
openssl (Debian package)
How to mitigate CVE-2026-63075
Install security update from vendor's website.
OpenSSL - addressed in versions 3.4.7, 3.5.8, 3.6.4, 4.0.2
openssl (Debian package) - update to 3.5.7-1~deb13u2
openssl (Debian package) - update to 3.5.7-1~deb13u2