Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-75804— QUIC Connection-Level Flow Control is Not Enforced for Streams

Quick assessment

Affected
OpenSSL OpenSSL
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75804

Vulnerability Information

Shenlong is analyzing...

Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
QUIC Connection-Level Flow Control is Not Enforced for Streams
Source: CVE Program / CVE List V5
Vulnerability Description
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The local QUIC stack advertises two flow control limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer must follow both limits when transmitting stream data. Whenever the local QUIC stack receives a stream frame, it validates that the size of the received stream frame stays within flow control limits. If either limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a flow control error. The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-level limit. To exploit the issue, three conditions must be met: - the remote peer opens several streams - each stream must stay within the stream-level flow control limit - there must be no zero-offset byte sent on any of the streams (to prevent the vulnerable QUIC stack from consuming data). By meeting the conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenSSL OpenSSL 4.0.0 ~ 4.0.3 -

II. Public POCs for CVE-2026-75804

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75804

请登录查看更多情报信息。

Other References for CVE-2026-75804 (5)

Same Patch Batch · OpenSSL · 2026-09-29 · 14 CVEs total

CVE-2026-35189 Excessive Memory Allocation in Relative CRLDP Processing
CVE-2026-35191 QUIC Unvalidated Amplification Credit may be Over Accounted
CVE-2026-75806 Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS
CVE-2026-75805 NULL Pointer Dereference in CMP Client Revocation Response Handling
CVE-2026-42772 Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC
CVE-2026-54873 QUIC STREAM Fragment Metadata DoS
CVE-2026-54872 Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves
CVE-2026-54875 Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V
CVE-2026-77696 Timing Side-Channel in SM2 Signature Generation
CVE-2026-72897 Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake
CVE-2026-84782 DTLS Retransmits Handshake Messages From a Stale Buffer Offset
CVE-2026-84784 QUIC: Unbounded RETIRE_CONNECTION_ID Backlog
CVE-2026-84783 Use-After-Free in X.509 Extension Cache Under Concurrent Use

IV. Related Vulnerabilities

Same product: OpenSSL
Same vendor: OpenSSL
Same weakness: CWE-770

V. Comments for CVE-2026-75804

No comments yet

Leave a comment