CVE-2026-63075 in OpenSSL
Summary
by MITRE • 08/25/2026
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection.
Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service.
The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself.
FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The identified vulnerability represents a significant resource management flaw within the OpenSSL implementation of the QUIC protocol, specifically affecting how acknowledgment frames are handled during network communication. In standard QUIC operations, when an endpoint sends data packets that require confirmation, it expects to receive acknowledgments from its peer. However, there is also a mechanism for sending ACK-only packets, which serve purely as confirmations and do not themselves elicit further acknowledgments under the protocol specification. The core technical flaw lies in OpenSSL's decision to retain metadata associated with these ACK-only packet transmissions indefinitely throughout the lifespan of the connection. While storing such metadata might be benign during normal operation where peers reciprocate appropriately, it becomes a critical liability when interacting with untrusted or malicious network endpoints that do not adhere to expected behavioral norms regarding acknowledgment reciprocity.
The operational impact of this flaw is severe, primarily manifesting as a remote denial-of-service condition through memory exhaustion. An attacker who can successfully complete the QUIC handshake with an OpenSSL-based server gains the ability to trigger this vulnerability without requiring any authentication or elevated privileges beyond establishing a connection. By repeatedly sending ack-eliciting packets such as PING frames and subsequently withholding acknowledgments for legitimate data, the malicious peer forces the OpenSSL implementation to generate numerous ACK-only responses. Because each of these generated packets has its metadata retained in memory rather than being discarded after transmission, the server experiences continuous and unbounded memory growth. This behavior is particularly dangerous under sustained traffic conditions or when many concurrent QUIC connections are active simultaneously, as the cumulative effect can quickly deplete available system resources, causing the service to become unresponsive or crash entirely.
From a classification perspective, this vulnerability aligns directly with CWE-770, which describes the allocation of resources without limits or throttling. The failure to implement proper bounds checking on memory retention for packet metadata constitutes an unchecked resource consumption pattern that is exploitable by remote actors. Furthermore, in terms of attack tactics and techniques, this scenario maps closely to ATT&CK technique T1498, specifically Network Denial of Service via Resource Exhaustion. The attacker leverages the protocol's own mechanisms against the implementation, using legitimate-looking traffic patterns to induce a state where the system consumes excessive memory, thereby degrading availability for all users relying on that service instance.
The remediation strategy involves modifying the internal packet history management logic within the OpenSSL QUIC stack. Instead of storing full metadata for every ACK-only packet transmitted, the fix ensures that these transmissions are accounted for in terms of high and low watermarks used for tracking packet loss and retransmission needs, without retaining the actual metadata structures themselves. This approach maintains the necessary state information required for protocol correctness while eliminating the memory leak vector. By decoupling the accounting mechanism from persistent storage for non-eliciting acknowledgments, OpenSSL prevents malicious peers from forcing indefinite memory accumulation. It is important to note that this issue does not impact the FIPS module of OpenSSL, as the QUIC implementation resides outside the boundary of the cryptographic modules subject to Federal Information Processing Standards compliance requirements.