AIKIDO-2026-528290
openssl is vulnerable to Double Free
55
Medium Risk
This Affects:
opensslTL;DR
The QUIC server creates a QRX record layer object to validate an Initial packet and then passes that object into channel setup. If channel setup fails, including when the destination connection ID is shorter than 8 bytes, the setup path frees the QRX object and the packet handler frees it again, which corrupts the heap and typically terminates the QUIC server process. The fix frees the QRX object only once on that failure path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application runs an OpenSSL QUIC server.
Background info
openssl is vulnerable to Double Free in versions 3.5.0 - 3.5.7, 3.6.0 - 3.6.3 and 4.0.0 - 4.0.1.
How to fix this
Upgrade the openssl library to the patch version.
Links
GitHub Release
Fix Commits
github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13afgithub.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3cgithub.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.