CVE-2026-63075— QUIC ACK包保留可导致内存耗尽
一分钟漏洞结论
影响对象
OpenSSL OpenSSL
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
问题摘要：当 OpenSSL 处理来自对等方的 QUIC 流量时，如果对等方反复发送会触发 ACK 确认的包，却从不响应仅包含 ACK 的包，QUIC 协议栈可能会在连接生命周期内持续保留仅包含 ACK 的包元数据。 影响摘要：远程对等方若已完成 QUIC 握手，可导致连接范围内的内存持续增长，进而可能因内存耗尽引发拒绝服务（DoS）攻击。在持续流量或大量并发 QUIC 连接的情况下，此风险尤为显著。 CWE 编号：CWE-770：未限制或未节流地分配资源 详细描述：当 OpenSSL 的 QUIC 协议栈发送仅包
可能的 ATT&CK 技术 1 AI
T1499.004 · Application or System Exploitation
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-63075 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
QUIC ACK-only Packet Retention Can Cause Memory Exhaustion
来源: CVE Program / CVE List V5
Vulnerability Description
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly
sends ack-eliciting packets while not acknowledging ACK-only responses, the
QUIC stack can retain ACK-only packet metadata for the lifetime of the
connection.
Impact summary: A remote peer that can complete a QUIC handshake can
cause connection-scoped memory growth which may lead to Denial of Service
through memory exhaustion, especially with sustained traffic or many concurrent
QUIC connections.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Description: When the OpenSSL QUIC stack sends an ACK-only packet,
there is no requirement by the QUIC protocol that the peer will acknowledge
that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL
implementation stores the metadata about the ACK frames regardless.
In and of itself that's ok, but if a malicious peer establishes a connection, and
then drives the connection such that ACK-only packets are forced from the
OpenSSL implementation peer (i.e., by sending numerous PING frames),
and then withholding any subsequent acks for ack-eliciting data, like
legitimate data, said malicious peer can force inappropriate memory growth
on the OpenSSL peer, potentially leading to a Denial of Service.
The fix is to ensure that we account for the transmission of the ACK-only
packet in the packet histories high and low watermark without actually storing
the ACK-only packet metadata itself.
FIPS impact: no
The OpenSSL FIPS module is not affected as the QUIC code is
outside the FIPS module boundary.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-63075 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-63075 的情报信息
请登录查看更多情报信息。
CVE-2026-63075 补丁与修复 (4)
CVE-2026-63075 厂商安全公告 (1)
同批安全公告 · OpenSSL · 2026-08-25 · 共 9 条
| CVE-2026-75803 | EVP_Cipher()使用AEAD时空密文伪造漏洞 | |
| CVE-2026-18798 | QUIC Server 处理初始包时可能触发双重释放漏洞 | |
| CVE-2026-54874 | DTLS记录缓冲区过度内存使用漏洞 | |
| CVE-2026-63074 | ExtraCerts 无限缓存增长漏洞 | |
| CVE-2026-63072 | CMS 密钥解封装中的堆缓冲区溢出漏洞 | |
| CVE-2026-63073 | CMP响应验证中未信任的发送者DN被用作格式字符串漏洞 | |
| CVE-2026-63076 | CMP Server 保护算法构造指针解引用漏洞 | |
| CVE-2026-14457 | RPK 服务器签名算法选择可导致引用缺失证书的漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-63075
暂无评论