OpenSSL QUIC Server Vulnerability: Double Free in Packet Processing

CVE-2026-18798

What is CVE-2026-18798?

The OpenSSL QUIC server contains a vulnerability where a double free of a QRX object occurs during the validation of an initial packet. This situation arises when the server attempts to establish a channel upon receiving a malformed packet that does not comply with RFC 9000. If the initial packet is invalid (specifically, if the destination connection ID is shorter than 8 bytes), the server's error handling routine triggers a second attempt to free the already released QRX object. This logic flaw can lead to heap corruption, causing the QUIC server process to terminate unexpectedly, resulting in a Denial of Service condition.

References