AIKIDO-2026-956980
openssl is vulnerable to Denial of Service (DoS)
37
Low Risk
This Affects:
opensslTL;DR
An OpenSSL QUIC listener allocates a new channel for each valid Initial packet whose destination connection ID is unknown, and queues it until the application calls SSL_accept(). Nothing caps that queue, so a peer that sends Initial packets faster than the application accepts them can grow memory without a bound and make the listener unavailable. The fix limits pending channels, with a default of 256.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application accepts OpenSSL QUIC connections.
Background info
openssl is vulnerable to Denial of Service (DoS) in versions 3.5.0 - 3.5.7, 3.6.0 - 3.6.3 and 4.0.0 - 4.0.1.
How to fix this
Upgrade the openssl library to the patch version.
Links
GitHub Release
Fix Commits
github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6bgithub.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.