Catalogo CVE
CVE-2026-18798
Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically resu
- Gravità
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 1.54% · Oct 22, 2026
Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | openssl | sid | 3.6.5-1 | fixed |
| Debian | openssl | forky | 3.6.5-1 | fixed |
| Debian | openssl | trixie | 3.5.7-1~deb13u2 | fixed |
| Debian | openssl | trixie-security | 3.5.7-1~deb13u3 | fixed |
| Debian | openssl | bookworm | 3.0.20-1~deb12u2 | not affected |
| Debian | openssl | bookworm-security | 3.0.22-1~deb12u1 | not affected |
| Ubuntu | openssl | noble | 3.0.13-0ubuntu3.15 | fixed |
| Ubuntu | libssl-dev | noble | 3.0.13-0ubuntu3.15 | fixed |
| Ubuntu | libssl-doc | noble | 3.0.13-0ubuntu3.15 | fixed |
| Ubuntu | libssl3t64 | noble | 3.0.13-0ubuntu3.15 | fixed |
| Cpe | openssl | Not reported | 4.0.2 | fixed |
| Alpine | openssl | 3.22 | 3.5.8-r0 | fixed |
| Alpine | openssl | 3.23 | 3.5.8-r0 | fixed |
| Alpine | openssl | 3.24 | 3.5.8-r0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | openssl | source | sid | 3.6.4-1 | not yet assigned | Not reported | Not reported |
| Debian | openssl | source | forky | 3.6.4-1 | not yet assigned | Not reported | Not reported |
| Debian | openssl | source | trixie | 3.5.7-1~deb13u2 | not yet assigned | Not reported | Not reported |
| Debian | openssl | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Ubuntu | openssl | deb | noble | 3.0.13-0ubuntu3.15 | Not reported | Not reported | Not reported |
| Ubuntu | libssl-dev | deb | noble | 3.0.13-0ubuntu3.15 | Not reported | Not reported | Not reported |
| Ubuntu | libssl-doc | deb | noble | 3.0.13-0ubuntu3.15 | Not reported | Not reported | Not reported |
| Ubuntu | libssl3t64 | deb | noble | 3.0.13-0ubuntu3.15 | Not reported | Not reported | Not reported |
| Cpe | openssl | cpe | Not reported | 4.0.2 | Not reported | NVD-CVE-2026-18798 | Not reported |
| Alpine | openssl | apk | 3.22 | 3.5.8-r0 | Not reported | ALPINE-CVE-2026-18798 | Not reported |
| Alpine | openssl | apk | 3.23 | 3.5.8-r0 | Not reported | ALPINE-CVE-2026-18798 | Not reported |
| Alpine | openssl | apk | 3.24 | 3.5.8-r0 | Not reported | ALPINE-CVE-2026-18798 | Not reported |
OpenFactory catalog packages
L’associazione dei pacchetti è in corso.
[Debian 12 (Bookworm)]
- [libssl3]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.0.20-1~deb12u2· amd64 · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· amd64 · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· amd64 · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· arm64 · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
- [libssl-dev]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.0.20-1~deb12u2· amd64 · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· amd64 · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· amd64 · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· arm64 · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
- [libssl-doc]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.0.20-1~deb12u2· all · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· all · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· all · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· all · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· all · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· all · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
- [openssl]Sconosciuto
Dettagli (6)
3.0.20-1~deb12u2· amd64 · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· amd64 · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· amd64 · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· arm64 · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
[Debian 13 (Trixie)]
- [libssl3t64]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.5.6-1~deb13u2· amd64 · trixieInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
- [libssl-dev]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.5.6-1~deb13u2· amd64 · trixieInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
- [libssl-doc]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.5.6-1~deb13u2· all · trixieInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· all · trixieInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· all · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· all · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· all · trixie-security · Historical versionCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u3· all · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
- [openssl]Sconosciuto
Dettagli (6)
3.5.6-1~deb13u2· amd64 · trixieInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
- [openssl-provider-fips]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.5.6-1~deb13u2· amd64 · trixieInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
- [openssl-provider-legacy]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.5.6-1~deb13u2· amd64 · trixieInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u2nvd · openssl · debian · 13
Osservato:
Riferimenti
- [https://access.redhat.com/errata/RHSA-2026:67154]
- [https://ftp.suse.com/pub/projects/security/]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-18798]
- [https://osv.dev/vulnerability/ALPINE-CVE-2026-18798]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-18798]
- [https://security-tracker.debian.org/tracker/CVE-2026-18798]
- [https://ubuntu.com/security/notices/USN-8678-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3034.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]