NULL Pointer Dereference Vulnerability in OpenSSL QUIC Server

CVE-2026-42764

What is CVE-2026-42764?

A vulnerability in the OpenSSL QUIC server arises when an initial packet with an invalid token is received, leading to a NULL pointer dereference. This can result in the abnormal termination of the QUIC server process, creating a potential Denial of Service situation. The issue primarily affects configurations where the address validation is disabled. While the default configuration is safe, using the SSL_LISTENER_FLAG_NO_VALIDATE option exposes the server to this risk if the SSL_new_listener() function is called. The vulnerability does not impact the FIPS modules, as the problematic code is outside their scope.

References