CVE-2026-63075

*** Pendiente de traducción *** Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly<br /> sends ack-eliciting packets while not acknowledging ACK-only responses, the<br /> QUIC stack can retain ACK-only packet metadata for the lifetime of the<br /> connection.<br /> <br /> Impact summary: A remote peer that can complete a QUIC handshake can<br /> cause connection-scoped memory growth which may lead to Denial of Service<br /> through memory exhaustion, especially with sustained traffic or many concurrent<br /> QUIC connections.<br /> <br /> CWE: CWE-770: Allocation of Resources Without Limits or Throttling<br /> <br /> Description: When the OpenSSL QUIC stack sends an ACK-only packet,<br /> there is no requirement by the QUIC protocol that the peer will acknowledge<br /> that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL<br /> implementation stores the metadata about the ACK frames regardless.<br /> In and of itself that&amp;#39;s ok, but if a malicious peer establishes a connection, and<br /> then drives the connection such that ACK-only packets are forced from the <br /> OpenSSL implementation peer (i.e., by sending numerous PING frames),<br /> and then withholding any subsequent acks for ack-eliciting data, like<br /> legitimate data, said malicious peer can force inappropriate memory growth<br /> on the OpenSSL peer, potentially leading to a Denial of Service.<br /> <br /> The fix is to ensure that we account for the transmission of the ACK-only<br /> packet in the packet histories high and low watermark without actually storing<br /> the ACK-only packet metadata itself.<br /> <br /> FIPS impact: no<br /> The OpenSSL FIPS module is not affected as the QUIC code is<br /> outside the FIPS module boundary.