CVE-2026-34183

HighCVSS 7.5/10Last modified Jul 23, 2026

Description

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1325

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-341849.1AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directori CVE-2026-341858.8AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated CVE-2026-341868.8Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects CVE-2026-341879.8Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This is CVE-2026-341887.2Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. Th CVE-2026-341895.9Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticat CVE-2026-34195.3Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 911 CVE-2026-341905.9Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when CVE-2026-341919.1Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via ap CVE-2026-341927.7Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading to UAF of GPU page CVE-2026-341934.3Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outsi CVE-2026-341947.1Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of a mapping state maintain