Denial of Service Vulnerability in OpenSSL QUIC Server by OpenSSL

CVE-2026-14456

What is CVE-2026-14456?

An issue exists in OpenSSL's QUIC server implementation that allows a remote attacker to send numerous valid QUIC Initial packets with unknown destination connection IDs. This can lead to unrestricted memory allocation as the server creates new connection channels. If the application does not handle these connections promptly, it may cause the QUIC listener to become unavailable due to excessive memory consumption, potentially resulting in a Denial of Service. As a corrective measure, a limit for pending connections has been introduced, set by default to 256, which can be adjusted by applications as needed.

References