CVE catalog
CVE-2026-34183
Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbo
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.05% · Oct 25, 2026
Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | openssl | sid | 3.6.5-1 | fixed |
| Debian | openssl | forky | 3.6.5-1 | fixed |
| Debian | openssl | trixie | 3.5.7-1~deb13u2 | fixed |
| Debian | openssl | trixie-security | 3.5.7-1~deb13u3 | fixed |
| Debian | openssl | bookworm | 3.0.20-1~deb12u2 | not affected |
| Debian | openssl | bookworm-security | 3.0.22-1~deb12u2 | not affected |
| Cpe | openssl | Not reported | 3.0.13-0ubuntu3.11 | fixed |
| Cpe | libssl-dev | Not reported | 3.0.13-0ubuntu3.11 | fixed |
| Cpe | libssl-doc | Not reported | 3.0.13-0ubuntu3.11 | fixed |
| Cpe | libssl3t64 | Not reported | 3.0.13-0ubuntu3.11 | fixed |
| Cpe | openssl | Not reported | 3.4.6 | fixed |
| Cpe | openssl | Not reported | 3.5.7 | fixed |
| Cpe | openssl | Not reported | 3.6.3 | fixed |
| Cpe | openssl | Not reported | Not reported | unknown |
| Cpe | openssl | Not reported | Not reported | not affected |
| Alpine | openssl | 3.21 | 3.3.7-r1 | fixed |
| Alpine | openssl | 3.22 | 3.5.7-r0 | fixed |
| Alpine | openssl | 3.23 | 3.5.7-r0 | fixed |
| Alpine | openssl | 3.24 | 3.5.7-r0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | openssl | source | sid | 3.6.3-1 | not yet assigned | Not reported | [1139674] |
| Debian | openssl | source | forky | 3.6.3-1 | not yet assigned | Not reported | [1139674] |
| Debian | openssl | source | trixie | 3.5.6-1~deb13u2 | not yet assigned | Not reported | [1139674] |
| Debian | openssl | source | bookworm | Not affected | unimportant | Not reported | [1139674] |
| Cpe | openssl | cpe | Not reported | 3.0.13-0ubuntu3.11 | Not reported | Not reported | Not reported |
| Cpe | libssl-dev | cpe | Not reported | 3.0.13-0ubuntu3.11 | Not reported | Not reported | Not reported |
| Cpe | libssl-doc | cpe | Not reported | 3.0.13-0ubuntu3.11 | Not reported | Not reported | Not reported |
| Cpe | libssl3t64 | cpe | Not reported | 3.0.13-0ubuntu3.11 | Not reported | Not reported | Not reported |
| Cpe | openssl | cpe | Not reported | 3.4.6 | Not reported | Not reported | Not reported |
| Cpe | openssl | cpe | Not reported | 3.5.7 | Not reported | Not reported | Not reported |
| Cpe | openssl | cpe | Not reported | 3.6.3 | Not reported | Not reported | Not reported |
| Alpine | openssl | apk | 3.21 | 3.3.7-r1 | Not reported | ALPINE-CVE-2026-34183 | Not reported |
| Alpine | openssl | apk | 3.22 | 3.5.7-r0 | Not reported | ALPINE-CVE-2026-34183 | Not reported |
| Alpine | openssl | apk | 3.23 | 3.5.7-r0 | Not reported | ALPINE-CVE-2026-34183 | Not reported |
| Alpine | openssl | apk | 3.24 | 3.5.7-r0 | Not reported | ALPINE-CVE-2026-34183 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libssl3]Not affected
Source package: [openssl]
Details (6)
3.0.20-1~deb12u2· amd64 · bookwormNot affected
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookwormNot affected
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· amd64 · bookworm-securityNot affected
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookworm-securityNot affected
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· amd64 · bookworm-updatesNot affected
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· arm64 · bookworm-updatesNot affected
nvd · openssl · debian · bookworm
- [libssl-dev]Not affected
Source package: [openssl]
Details (6)
3.0.20-1~deb12u2· amd64 · bookwormNot affected
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookwormNot affected
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· amd64 · bookworm-securityNot affected
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookworm-securityNot affected
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· amd64 · bookworm-updatesNot affected
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· arm64 · bookworm-updatesNot affected
nvd · openssl · debian · bookworm
- [libssl-doc]Not affected
Source package: [openssl]
Details (6)
3.0.20-1~deb12u2· all · bookwormNot affected
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· all · bookwormNot affected
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· all · bookworm-securityNot affected
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· all · bookworm-securityNot affected
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· all · bookworm-updatesNot affected
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· all · bookworm-updatesNot affected
nvd · openssl · debian · bookworm
- [openssl]Not affected
Details (6)
3.0.20-1~deb12u2· amd64 · bookwormNot affected
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookwormNot affected
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· amd64 · bookworm-securityNot affected
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookworm-securityNot affected
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· amd64 · bookworm-updatesNot affected
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· arm64 · bookworm-updatesNot affected
nvd · openssl · debian · bookworm
[Debian 13 (Trixie)]
- [libssl3t64]Fixed
Source package: [openssl]
Details (6)
3.5.6-1~deb13u2· amd64 · trixieFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
- [libssl-dev]Fixed
Source package: [openssl]
Details (6)
3.5.6-1~deb13u2· amd64 · trixieFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
- [libssl-doc]Fixed
Source package: [openssl]
Details (6)
3.5.6-1~deb13u2· all · trixieFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· all · trixieFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· all · trixie-security · Historical versionFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· all · trixie-securityFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· all · trixie-security · Historical versionFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u3· all · trixie-securityFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
- [openssl]Fixed
Details (6)
3.5.6-1~deb13u2· amd64 · trixieFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
- [openssl-provider-fips]Fixed
Source package: [openssl]
Details (6)
3.5.6-1~deb13u2· amd64 · trixieFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
- [openssl-provider-legacy]Fixed
Source package: [openssl]
Details (6)
3.5.6-1~deb13u2· amd64 · trixieFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityFixed · Fixed:
3.5.6-1~deb13u2nvd · openssl · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_2648-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-34183]
- [https://osv.dev/vulnerability/ALPINE-CVE-2026-34183]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-34183]
- [https://security-tracker.debian.org/tracker/CVE-2026-34183]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34183.json]
- [https://ubuntu.com/security/notices/USN-8414-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2455.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]