Catalogo CVE
CVE-2026-42772
Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of
- Gravità
- Medium · CVSS 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.33% · Oct 22, 2026
Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407: Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations, consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | openssl | sid | 3.6.5-1 | fixed |
| Debian | openssl | forky | 3.6.5-1 | fixed |
| Debian | openssl | trixie | 3.5.7-1~deb13u2 | vulnerable |
| Debian | openssl | trixie-security | 3.5.7-1~deb13u3 | fixed |
| Debian | openssl | bookworm | 3.0.20-1~deb12u2 | not affected |
| Debian | openssl | bookworm-security | 3.0.22-1~deb12u1 | not affected |
| Cpe | openssl | Not reported | 4.0.3 | fixed |
| Ubuntu | openssl | 26.04 | 3.5.3-1ubuntu2 | vulnerable |
| Ubuntu | openssl | 26.04 | 3.5.5-1ubuntu1 | vulnerable |
| Ubuntu | openssl | 26.04 | 3.5.5-1ubuntu3 | vulnerable |
| Ubuntu | openssl | 26.04 | 3.5.5-1ubuntu3.2 | vulnerable |
| Ubuntu | openssl | 26.04 | 3.5.5-1ubuntu3.3 | vulnerable |
| Ubuntu | openssl | 26.04 | 3.5.5-1ubuntu3.4 | vulnerable |
| Ubuntu | openssl | 26.04 | 3.5.5-1ubuntu3.5 | vulnerable |
| Ubuntu | openssl | 26.04 | 3.5.5-1ubuntu3.6 | vulnerable |
| Ubuntu | openssl | 26.04 | 3.5.5-1ubuntu3.7 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | openssl | source | sid | 3.6.5-1 | not yet assigned | Not reported | Not reported |
| Debian | openssl | source | forky | 3.6.5-1 | not yet assigned | Not reported | Not reported |
| Debian | openssl | source | trixie | 3.5.7-1~deb13u3 | not yet assigned | Not reported | Not reported |
| Debian | openssl | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Cpe | openssl | cpe | Not reported | 4.0.3 | Not reported | NVD-CVE-2026-42772 | Not reported |
| Ubuntu | openssl | deb | 26.04 | 3.5.5-1ubuntu3.7 | Not reported | USN-8861-1 | Not reported |
OpenFactory catalog packages
L’associazione dei pacchetti è in corso.
[Debian 12 (Bookworm)]
- [libssl3]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.0.20-1~deb12u2· amd64 · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· amd64 · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· amd64 · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· arm64 · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
- [libssl-dev]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.0.20-1~deb12u2· amd64 · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· amd64 · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· amd64 · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· arm64 · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
- [libssl-doc]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.0.20-1~deb12u2· all · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· all · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· all · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· all · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· all · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· all · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
- [openssl]Sconosciuto
Dettagli (6)
3.0.20-1~deb12u2· amd64 · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookwormNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· amd64 · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.20-1~deb12u2· arm64 · bookworm-securityNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· amd64 · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
3.0.17-1~deb12u2· arm64 · bookworm-updatesNon interessata
nvd · openssl · debian · bookworm
[Debian 13 (Trixie)]
- [libssl3t64]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.5.6-1~deb13u2· amd64 · trixieInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
- [libssl-dev]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.5.6-1~deb13u2· amd64 · trixieInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
- [libssl-doc]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.5.6-1~deb13u2· all · trixieInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.6-1~deb13u2· all · trixieInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.6-1~deb13u2· all · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u2· all · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u2· all · trixie-securityInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u3· all · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
- [openssl]Sconosciuto
Dettagli (6)
3.5.6-1~deb13u2· amd64 · trixieInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
- [openssl-provider-fips]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.5.6-1~deb13u2· amd64 · trixieInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
- [openssl-provider-legacy]Sconosciuto
Pacchetto sorgente: [openssl]
Dettagli (6)
3.5.6-1~deb13u2· amd64 · trixieInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.6-1~deb13u2· arm64 · trixieInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.6-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u2· amd64 · trixie-security · Historical versionInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u2· arm64 · trixie-securityInteressata · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
3.5.7-1~deb13u3· amd64 · trixie-securityCorretta · Corretta:
3.5.7-1~deb13u3nvd · openssl · debian · 13
Osservato:
Riferimenti
- [https://access.redhat.com/errata/RHSA-2026:74162]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-42772]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-42772]
- [https://osv.dev/vulnerability/USN-8861-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-42772]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3638.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]