CVE-2026-18798

*** Pendiente de traducción *** Issue summary: QUIC server may double free QRX (QUIC record layer RX) object<br /> when channel creation fails for initial packet.<br /> <br /> Impact summary: Double free leads to heap corruption, which typically results in <br /> termination of QUIC server process, leading to Denial of Service. There is so<br /> far no evidence that this double free is exploitable for remote code execution,<br /> thus it is considered highly improbable.<br /> <br /> CWE: CWE-415: Double Free<br /> <br /> Description: In order to validate initial packet, OpenSSL QUIC stack default<br /> packet handler (port_default_packet_handler()) creates a so-called QRX object.<br /> If the initial packet validates successfully with QRX object, the default packet<br /> handler proceeds to channel (connection object) creation. The QRX object used<br /> for packet validation is passed to port_bind_channel(), so it becomes part of<br /> the newly created connection. If port_bind_channel() fails, then it also frees<br /> the QRX object. Once port_bind_channel() returns, the port_default_packet_handler()<br /> detects the failure and proceeds to the error branch, where the same QRX object is<br /> freed for the second time.<br /> <br /> The failure in port_bind_channel() function can be induced with a relatively<br /> low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet<br /> carries DCID (destination connection ID) which is shorter than 8 bytes, then<br /> port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()<br /> detects that the DCID has invalid length.<br /> <br /> FIPS impact: no<br /> The FIPS module is not affected, as the QUIC implementation is outside of<br /> the OpenSSL FIPS module boundary.