Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-18798— QUIC Server May Trigger Double Free When Processing INITIAL Packet

Quick assessment

Affected
OpenSSL OpenSSL
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

漏洞摘要：当初始数据包的通道创建失败时，QUIC 服务器可能对 QRX（QUIC 记录层接收方向）对象执行双重释放（double free）。 影响摘要：双重释放会导致堆损坏，通常引起 QUIC 服务器进程终止，从而导致拒绝服务（DoS）。截至目前，尚无证据表明此双重释放可被远程利用以执行任意代码，因此认为其被远程代码执行利用的可能性极低。 CWE：CWE-415：双重释放 详细描述：为了验证初始数据包，OpenSSL QUIC 栈的默认数据包处理器（ ）会创建一个所谓的 QRX 对象。如果初始数据包通过 QRX

AI Predicted 7.5 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 3

VendorProduct Version RangeStatus
OpenSSL OpenSSL 4.0.0< 4.0.2 affected
3.6.0< 3.6.4 affected
3.5.0< 3.5.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-18798

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
QUIC Server May Trigger Double Free When Processing INITIAL Packet
Source: CVE Program / CVE List V5
Vulnerability Description
Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
双重释放
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenSSL OpenSSL 4.0.0 ~ 4.0.2 -

II. Public POCs for CVE-2026-18798

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-18798

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-18798 (3)

Vendor Advisories for CVE-2026-18798 (1)

Same Patch Batch · OpenSSL · 2026-08-25 · 9 CVEs total

CVE-2026-75803 AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()
CVE-2026-54874 Excessive Memory Use Buffering DTLS Records for a Future Epoch
CVE-2026-63074 CMP Indefinite Cache Growth of ExtraCerts
CVE-2026-63072 Heap Buffer Overflow in CMS Key Unwrapping
CVE-2026-63073 Untrusted Sender DN Used as Format String in CMP Response Validation
CVE-2026-63075 QUIC ACK-only Packet Retention Can Cause Memory Exhaustion
CVE-2026-63076 Invalid Pointer Dereference in CMP Server via Crafted protectionAlg
CVE-2026-14457 RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate

IV. Related Vulnerabilities

Same product: OpenSSL
Same vendor: OpenSSL
Same weakness: CWE-415

V. Comments for CVE-2026-18798

No comments yet

Leave a comment