p PatchFirst

CVE-2026-34183

CVE-2026-34183 · Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

CVSS 7.5 · High · EPSS 1.0% · Fix available

Published
Updated

Stack: system · network

Affected products and versions

  • openssl

    Versions
    • ≥ 4.0.0, < 4.0.1: Affected (semver)
    • ≥ 3.6.0, < 3.6.3: Affected (semver)
    • ≥ 3.5.0, < 3.5.7: Affected (semver)
    • ≥ 3.4.0, < 3.4.6: Affected (semver)

    Update to 3.4.6; Update to 3.5.7; Update to 3.6.3; Update to 4.0.1

  • openssl Debian:13

    Versions
    • 3.5.1-1
    • 3.5.1-1+deb13u1
    • 3.5.2-1
    • 3.5.3-1
    • 3.5.4-1
    • 3.5.4-1~deb13u1
    • 3.5.4-1~deb13u2
    • 3.5.5-1
    • 3.5.5-1~deb13u1
    • 3.5.5-1~deb13u2
    • 3.5.6-1~deb13u1
    Affected ranges
    • ECOSYSTEM: < 3.5.6-1~deb13u2

    Update to 3.5.6-1~deb13u2

  • openssl Debian:14

    Versions
    • 3.5.1-1
    • 3.5.2-1
    • 3.5.3-1
    • 3.5.4-1
    • 3.5.4-1~deb13u1
    • 3.5.4-1~deb13u2
    • 3.5.5-1
    • 3.5.5-1~deb13u1
    • 3.5.5-1~deb13u2
    • 3.5.6-1~deb13u1
    • 3.5.6-1~deb13u2
    • 3.5.7-1~deb13u1
    • 3.5.7-1~deb13u2
    • 3.5.7-1~deb13u3
    • 3.6.0-1
    • 3.6.0-2
    • 3.6.0~~alpha1-1
    • 3.6.0~~beta1-1
    • 3.6.1-1
    • 3.6.1-2
    • 3.6.1-3
    • 3.6.2-1
    Affected ranges
    • ECOSYSTEM: < 3.6.3-1

    Update to 3.6.3-1

  • nodejs Ubuntu:Pro:22.04:LTS

    Versions
    • 12.22.5~dfsg-5ubuntu1
    • 12.22.7~dfsg-2ubuntu1
    • 12.22.7~dfsg-2ubuntu3
    • 12.22.9~dfsg-1ubuntu2
    • 12.22.9~dfsg-1ubuntu3
    • 12.22.9~dfsg-1ubuntu3.1
    • 12.22.9~dfsg-1ubuntu3.2
    • 12.22.9~dfsg-1ubuntu3.3
    • 12.22.9~dfsg-1ubuntu3.4
    • 12.22.9~dfsg-1ubuntu3.5
    • 12.22.9~dfsg-1ubuntu3.6
    • 12.22.9~dfsg-1ubuntu3.6+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • edk2 Ubuntu:25.10

    Versions
    • 2025.02-3ubuntu2
    • 2025.02-8
    • 2025.02-8ubuntu1
    • 2025.02-8ubuntu2
    • 2025.02-8ubuntu3
    • 2025.02-8ubuntu3.1
    • 2025.02-8ubuntu3.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssl Ubuntu:25.10

    Versions
    • 3.4.1-1ubuntu3
    • 3.5.0-2ubuntu1
    • 3.5.2-1ubuntu1
    • 3.5.3-1ubuntu2
    • 3.5.3-1ubuntu3
    • 3.5.3-1ubuntu3.3
    Affected ranges
    • ECOSYSTEM: < 3.5.3-1ubuntu3.4

    Update to 3.5.3-1ubuntu3.4

  • edk2 Ubuntu:26.10

    Versions
    • 2025.11-3ubuntu7
    • 2025.11-3ubuntu8
    • 2026.05-2ubuntu1
    • 2026.05-2ubuntu2
    • 2026.05-2ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • edk2-hwe Ubuntu:26.10

    Versions
    • 2025.11-3ubuntu8
    • 2025.11-3ubuntu9
    • 2026.05-2ubuntu1
    • 2026.05-2ubuntu2
    • 2026.05-2ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • edk2 Ubuntu:26.04:LTS

    Versions
    • 2025.02-8ubuntu3
    • 2025.11-3ubuntu6
    • 2025.11-3ubuntu7
    • 2025.11-3ubuntu7.2
    • 2025.11-3ubuntu7.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • edk2-hwe Ubuntu:26.04:LTS

    Versions
    • 2025.11-3ubuntu6
    • 2025.11-3ubuntu8
    • 2025.11-3ubuntu8.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssl Ubuntu:26.04:LTS

    Versions
    • 3.5.3-1ubuntu2
    • 3.5.5-1ubuntu1
    • 3.5.5-1ubuntu3
    Affected ranges
    • ECOSYSTEM: < 3.5.5-1ubuntu3.2

    Update to 3.5.5-1ubuntu3.2

Original sources

Check your server →