CVE catalog

CVE-2026-75804

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summar

[CVE catalog]

Severity: High · CVSS 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Published: Sep 29, 2026, 4:17:07 PM UTC
Updated: Sep 29, 2026, 4:17:10 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.35% · Oct 22, 2026

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The local QUIC stack advertises two flow control limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer must follow both limits when transmitting stream data. Whenever the local QUIC stack receives a stream frame, it validates that the size of the received stream frame stays within flow control limits. If either limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a flow control error. The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-level limit. To exploit the issue, three conditions must be met: - the remote peer opens several streams - each stream must stay within the stream-level flow control limit - there must be no zero-offset byte sent on any of the streams (to prevent the vulnerable QUIC stack from consuming data). By meeting the conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	openssl	sid	`3.6.5-1`	fixed
Debian	openssl	forky	`3.6.5-1`	fixed
Debian	openssl	trixie	`3.5.7-1~deb13u2`	vulnerable
Debian	openssl	trixie-security	`3.5.7-1~deb13u3`	fixed
Debian	openssl	bookworm	`3.0.20-1~deb12u2`	not affected
Debian	openssl	bookworm-security	`3.0.22-1~deb12u1`	not affected
Ubuntu	openssl	noble	`3.0.13-0ubuntu3.16`	fixed
Ubuntu	libssl-dev	noble	`3.0.13-0ubuntu3.16`	fixed
Ubuntu	libssl-doc	noble	`3.0.13-0ubuntu3.16`	fixed
Ubuntu	libssl3t64	noble	`3.0.13-0ubuntu3.16`	fixed
Cpe	openssl	Not reported	`4.0.3`	fixed
Alpine	openssl	3.21	`3.3.7-r2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	openssl	source	sid	`3.6.5-1`	not yet assigned	Not reported	Not reported
Debian	openssl	source	forky	`3.6.5-1`	not yet assigned	Not reported	Not reported
Debian	openssl	source	trixie	`3.5.7-1~deb13u3`	not yet assigned	Not reported	Not reported
Debian	openssl	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Ubuntu	openssl	deb	noble	`3.0.13-0ubuntu3.16`	Not reported	Not reported	Not reported
Ubuntu	libssl-dev	deb	noble	`3.0.13-0ubuntu3.16`	Not reported	Not reported	Not reported
Ubuntu	libssl-doc	deb	noble	`3.0.13-0ubuntu3.16`	Not reported	Not reported	Not reported
Ubuntu	libssl3t64	deb	noble	`3.0.13-0ubuntu3.16`	Not reported	Not reported	Not reported
Cpe	openssl	cpe	Not reported	`4.0.3`	Not reported	NVD-CVE-2026-75804	Not reported
Alpine	openssl	apk	3.21	`3.3.7-r2`	Not reported	ALPINE-CVE-2026-75804	Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

[libssl3t64]Affected
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
[libssl-dev]Affected
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
[libssl-doc]Affected
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · all · trixie
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · all · trixie
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · all · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · all · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · all · trixie-security
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · all · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
[openssl]Affected
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
[openssl-provider-fips]Affected
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
[openssl-provider-legacy]Affected
Source package: [openssl]
Details (6)
- 3.5.6-1~deb13u2 · amd64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · arm64 · trixie
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u2 · arm64 · trixie-security
  Affected · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13
- 3.5.7-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 3.5.7-1~deb13u3
  nvd · openssl · debian · 13

[Debian 12 (Bookworm)]

[libssl3]Not affected
Source package: [openssl]
Details (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm
[libssl-dev]Not affected
Source package: [openssl]
Details (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm
[libssl-doc]Not affected
Source package: [openssl]
Details (6)
- 3.0.20-1~deb12u2 · all · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · all · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · all · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · all · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · all · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · all · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm
[openssl]Not affected
Details (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm

Observed: Oct 24, 2026, 2:46:55 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]