CVE-2026-34183
Fixed in a distro release EPSS 1%CVSS 7.5
Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.
Products: OpenSSL
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | openssl | 1:3.5.5-4.el10_2.alma.1 |
| AlmaLinux 10 | openssl-devel | 1:3.5.5-4.el10_2.alma.1 |
| AlmaLinux 10 | openssl-libs | 1:3.5.5-4.el10_2.alma.1 |
| AlmaLinux 10 | openssl-perl | 1:3.5.5-4.el10_2.alma.1 |
| AlmaLinux 9 | openssl | 1:3.5.5-4.el9_8 |
| AlmaLinux 9 | openssl-devel | 1:3.5.5-4.el9_8 |
| AlmaLinux 9 | openssl-libs | 1:3.5.5-4.el9_8 |
| AlmaLinux 9 | openssl-perl | 1:3.5.5-4.el9_8 |
| Alpine 3.21 | openssl | 3.3.7-r1 |
| Alpine 3.22 | openssl | 3.5.7-r0 |
| Alpine 3.23 | openssl | 3.5.7-r0 |
| Alpine 3.24 | openssl | 3.5.7-r0 |
| Chainguard | libcrypto3 | 3.6.3-r0 |
| Chainguard | libcrypto3-2.34 | 3.6.3-r0 |
| Chainguard | openssl | 3.6.3-r0 |
| Chainguard | openssl-provider-fips-3.4.0 | 0 |
| Chainguard | openssl-provider-fips-3.4.0-dbg | 0 |
| Chainguard | openssl-provider-fips-3.6.0 | 0 |
| Chainguard | openssl-provider-fips-3.6.0-dbg | 0 |
| Debian 13 | openssl | 3.5.6-1~deb13u2 |
| Debian 14 | openssl | 3.6.3-1 |
| Red Hat Enterprise Linux 10.2 | openssl | 1:3.5.5-4.el10_2 |
| Red Hat Enterprise Linux 10.2 | openssl-debuginfo | 1:3.5.5-4.el10_2 |
| Red Hat Enterprise Linux 10.2 | openssl-debugsource | 1:3.5.5-4.el10_2 |
| Red Hat Enterprise Linux 10.2 | openssl-devel | 1:3.5.5-4.el10_2 |
| Red Hat Enterprise Linux 10.2 | openssl-libs | 1:3.5.5-4.el10_2 |
| Red Hat Enterprise Linux 10.2 | openssl-libs-debuginfo | 1:3.5.5-4.el10_2 |
| Red Hat Enterprise Linux 10.2 | openssl-perl | 1:3.5.5-4.el10_2 |
| Red Hat Enterprise Linux 9 | openssl | 1:3.5.5-4.el9_8 |
| Red Hat Enterprise Linux 9 | openssl-debuginfo | 1:3.5.5-4.el9_8 |
| Red Hat Enterprise Linux 9 | openssl-debugsource | 1:3.5.5-4.el9_8 |
| Red Hat Enterprise Linux 9 | openssl-devel | 1:3.5.5-4.el9_8 |
| Red Hat Enterprise Linux 9 | openssl-libs | 1:3.5.5-4.el9_8 |
| Red Hat Enterprise Linux 9 | openssl-libs-debuginfo | 1:3.5.5-4.el9_8 |
| Red Hat Enterprise Linux 9 | openssl-perl | 1:3.5.5-4.el9_8 |
| Red Hat Enterprise Linux eus 10.0 | openssl | 1:3.2.2-16.el10_0.7 |
| Red Hat Enterprise Linux eus 10.0 | openssl-debuginfo | 1:3.2.2-16.el10_0.7 |
| Red Hat Enterprise Linux eus 10.0 | openssl-debugsource | 1:3.2.2-16.el10_0.7 |
| Red Hat Enterprise Linux eus 10.0 | openssl-devel | 1:3.2.2-16.el10_0.7 |
| Red Hat Enterprise Linux eus 10.0 | openssl-libs | 1:3.2.2-16.el10_0.7 |
| Red Hat Enterprise Linux eus 10.0 | openssl-perl | 1:3.2.2-16.el10_0.7 |
| Red Hat hummingbird 1 | bootupd | 0:0.3.2-1.hum1 |
| Red Hat hummingbird 1 | chunkah | 0:0.6.0-3.hum1 |
| Red Hat hummingbird 1 | openssl | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-config-fips | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-devel | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-devel-engine | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-fips-provider-upstream | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-libs | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-perl | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl3 | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl3-devel | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl3-devel-engine | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl3-libs | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | python-cryptography | 0:50.0.0-1.hum1 |
| Red Hat hummingbird 1 | python3-cryptography | 0:50.0.0-1.hum1 |
| Red Hat hummingbird 1 | ruby3.3 | 0:3.3.10-23.6.hum1 |
| Red Hat hummingbird 1 | ruby3.3-bundled-gems | 0:3.3.10-23.6.hum1 |
| Red Hat hummingbird 1 | ruby3.3-default-gems | 0:3.3.10-23.6.hum1 |
| Red Hat hummingbird 1 | ruby3.3-devel | 0:3.3.10-23.6.hum1 |
| Red Hat hummingbird 1 | ruby3.3-doc | 0:3.3.10-23.6.hum1 |
| Red Hat hummingbird 1 | ruby3.3-libs | 0:3.3.10-23.6.hum1 |
| Red Hat hummingbird 1 | ruby3.4 | 0:3.4.10-31.7.hum1 |
| Red Hat hummingbird 1 | ruby3.4-bundled-gems | 0:3.4.10-31.7.hum1 |
| Red Hat hummingbird 1 | ruby3.4-default-gems | 0:3.4.10-31.7.hum1 |
| Red Hat hummingbird 1 | ruby3.4-devel | 0:3.4.10-31.7.hum1 |
| Red Hat hummingbird 1 | ruby3.4-doc | 0:3.4.10-31.7.hum1 |
| Red Hat hummingbird 1 | ruby3.4-libs | 0:3.4.10-31.7.hum1 |
| Red Hat hummingbird 1 | ruby4.0 | 0:4.0.6-37.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-bundled-gems | 0:4.0.6-37.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-default-gems | 0:4.0.6-37.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-devel | 0:4.0.6-37.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-doc | 0:4.0.6-37.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-libs | 0:4.0.6-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-bigdecimal | 0:3.1.5-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-bundler | 0:2.5.22-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-devel | 0:3.5.22-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-io-console | 0:0.7.1-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-irb | 0:1.13.1-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-json | 0:2.7.2-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-minitest | 0:5.20.0-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-power_assert | 0:2.0.3-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-psych | 0:5.1.2-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-racc | 0:1.7.3-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-rake | 0:13.1.0-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-rbs | 0:3.4.0-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-rdoc | 0:6.6.3.1-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-rexml | 0:3.4.4-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-rss | 0:0.3.1-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-rubygems | 0:3.5.22-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-test-unit | 0:3.6.1-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem3.3-typeprof | 0:0.21.9-23.6.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-bigdecimal | 0:4.0.1-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-bundler | 0:4.0.16-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-devel | 0:4.0.16-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-io-console | 0:0.8.2-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-irb | 0:1.16.0-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-json | 0:2.18.0-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-minitest | 0:6.0.0-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-power_assert | 0:3.0.1-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-psych | 0:5.3.1-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-racc | 0:1.8.1-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-rake | 0:13.3.1-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-rbs | 0:3.10.0-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-rdoc | 0:7.0.4-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-rexml | 0:3.4.4-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-rss | 0:0.3.2-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-rubygems | 0:4.0.16-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-test-unit | 0:3.7.5-37.3.hum1 |
| Red Hat hummingbird 1 | rubygem4.0-typeprof | 0:0.31.1-37.3.hum1 |
| Red Hat hummingbird 1 | rust-bootupd | 0:0.3.2-1.hum1 |
| Red Hat rhel eus 9.6 | openssl | 1:3.2.2-7.el9_6.4 |
| Red Hat rhel eus 9.6 | openssl-debuginfo | 1:3.2.2-7.el9_6.4 |
| Red Hat rhel eus 9.6 | openssl-debugsource | 1:3.2.2-7.el9_6.4 |
| Red Hat rhel eus 9.6 | openssl-devel | 1:3.2.2-7.el9_6.4 |
| Red Hat rhel eus 9.6 | openssl-libs | 1:3.2.2-7.el9_6.4 |
| Red Hat rhel eus 9.6 | openssl-perl | 1:3.2.2-7.el9_6.4 |
| Rocky Linux 10 | openssl | 1:3.5.5-4.el10_2 |
| Rocky Linux 9 | openssl | 1:3.5.5-4.el9_8 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | openssl-3 | 3.2.3-150700.5.36.1 |
| SUSE Linux Enterprise Server 16.0 | openssl-3 | 3.5.0-160000.8.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | openssl-3 | 3.5.0-160000.8.1 |
| SUSE Linux Micro 6.2 | openssl-3 | 3.5.0-160000.8.1 |
| Ubuntu 22.04 LTS | openssl | 3.0.2-0ubuntu1.25 |
| Ubuntu 24.04 LTS | openssl | 3.0.13-0ubuntu3.11 |
| Ubuntu 25.10 | edk2 | no fix |
| Ubuntu 25.10 | openssl | 3.5.3-1ubuntu3.4 |
| Ubuntu 26.04 LTS | edk2 | no fix |
| Ubuntu 26.04 LTS | edk2-hwe | no fix |
| Ubuntu 26.04 LTS | openssl | 3.5.5-1ubuntu3.2 |
| Ubuntu 26.10 | edk2 | no fix |
| Ubuntu 26.10 | edk2-hwe | no fix |
| Ubuntu Pro 22.04 LTS | nodejs | no fix |
| Wolfi | libcrypto3 | 3.6.3-r0 |
| Wolfi | openssl | 3.6.3-r0 |
| openSUSE Leap 16.0 | openssl-3 | 3.5.0-160000.8.1 |
| openSUSE Tumbleweed | openssl-3 | 3.5.3-6.1 |