CVE-2026-63075 OpenSSL CVE debrief

Who should care

Defenders responsible for OpenSSL QUIC connections, especially those with sustained traffic or many concurrent connections, should assess exposure and prioritize verification and mitigation.

Why it matters

A remote peer can cause memory growth in OpenSSL QUIC stack by repeatedly sending ack-eliciting packets without acknowledging ACK-only responses, potentially leading to Denial of Service through memory exhaustion. Defenders should prioritize verifying exposure of OpenSSL QUIC connections, especially with sustained traffic or many concurrent QUIC connections, and assess the need for compensating controls or monitoring.

• Denial of Service through memory exhaustion
• Memory growth in OpenSSL QUIC stack
• Potential for sustained traffic or many concurrent QUIC connections to exacerbate memory exhaustion

Technical summary

The OpenSSL QUIC stack stores metadata about ACK frames, which can lead to memory growth if a malicious peer withholds acks for ack-eliciting data. The fix ensures that ACK-only packet transmission is accounted for in packet histories without storing the metadata. This issue is caused by the OpenSSL implementation storing metadata about ACK frames regardless of whether the peer acknowledges the ACK-only packet. A malicious peer can drive the connection to force ACK-only packets from the OpenSSL implementation peer and withhold subsequent acks for ack-eliciting data, leading to inappropriate memory growth and potentially causing Denial of Service.

Defensive priority

Defenders should prioritize verifying exposure of OpenSSL QUIC connections, especially with sustained traffic or many concurrent QUIC connections, and assess the need for compensating controls or monitoring.

Recommended defensive actions

• Verify OpenSSL QUIC connections for exposure, especially with sustained traffic or many concurrent connections
• Assess the need for compensating controls or monitoring to mitigate potential Denial of Service
• Review and apply OpenSSL patches to fix the vulnerability
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The OpenSSL implementation stores metadata about ACK frames, which can lead to memory growth if a malicious peer withholds acks for ack-eliciting data. The fix ensures that ACK-only packet transmission is accounted for in packet histories without storing the metadata.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.