QUIC ACK-only Packet Retention Can Cause Memory Exhaustion (CVE-2026-63075)

What is affected, what to do

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption.

Update OpenSSL to version 4.0.2, OpenSSL to version 3.6.4, OpenSSL to version 3.5.8.

Affected

• OpenSSL lt 4.0.0..4.0.2
• OpenSSL lt 3.6.0..3.6.4
• OpenSSL lt 3.5.0..3.5.8
• OpenSSL lt 3.4.0..3.4.7

Fixed in

• OpenSSL 4.0.2
• OpenSSL 3.6.4
• OpenSSL 3.5.8
• OpenSSL 3.4.7

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory exhaustion, eventually resulting in a denial of service.

Source: redhat_csaf, suse_csaf, Ubuntu Security Notices, Debian Security Advisories, BSI WID Portal, BSI CSAF, NVD (NIST), cvelistv5, Microsoft Security Update Guide

Vendors and products

• Debian Openssl
• Freebsd Project Freebsd OS
• Meinberg Lantime
• Open Source Openssl
• OpenSSL OpenSSL
• Ubuntu Openssl

Weakness classes (CWE)

• CWE-770Allocation of Resources Without Limits or Throttling

  Base

  The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

  Entry at MITRE CWE-770

References & sources

• openssl-library.orgOpenSSL AdvisoryVendor advisory
• github.com4.0.2 git commitPatch
• github.com3.6.4 git commitPatch
• github.com3.5.8 git commitPatch
• github.com3.4.7 git commitPatch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 11.09.2026Initial analysis by NVDNVD

   Newly listed as affected:

   • OpenSSL (3.5.0 – before 3.5.8; 3.6.0 – before 3.6.4; 4.0.0 – before 4.0.2; 3.4.0 – before 3.4.7)

   New references:

   • https://github.com/openssl/openssl/commit/7308946576b12e64b8be53bcf0a120354b2b42bc
   • https://github.com/openssl/openssl/commit/7c98d79738549df92868e7dd9be4bbf061eed709
   • https://github.com/openssl/openssl/commit/bf84721c2548351176e367e6de505792f0118dc6
   • https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393

   and 1 more reference

   Show 6 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Product configuration	added	—	OR *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.5.0 up to (excluding) 3.5.8 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.6.0 up to (excluding) 3.6.4 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 4.0.0 up to (excluding) 4.0.2 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.4.0 up to (excluding) 3.4.7
   Reference type	added	—	OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/7308946576b12e64b8be53bcf0a120354b2b42bc Types: Patch
   Reference type	added	—	OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/7c98d79738549df92868e7dd9be4bbf061eed709 Types: Patch
   Reference type	added	—	OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/bf84721c2548351176e367e6de505792f0118dc6 Types: Patch
   Reference type	added	—	OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393 Types: Patch
   Reference type	added	—	OpenSSL Software Foundation: https://openssl-library.org/news/secadv/20260825.txt Types: Vendor Advisory

   Source identifier: nvd@nist.gov

2. 25.08.2026Record modifiedCISA ADP

   CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

   CISA assessment (SSVC): exploitation: none known, automatable: yes

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   CVSS	added	—	AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
   SSVC assessment	added	—	{"id":"CVE-2026-63075","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-08-25T14:36:48.832724Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 25.08.2026Receivedopenssl.org

   Weakness type: CWE-770

   Description added or changed

   New references:

   • https://github.com/openssl/openssl/commit/7308946576b12e64b8be53bcf0a120354b2b42bc
   • https://github.com/openssl/openssl/commit/7c98d79738549df92868e7dd9be4bbf061eed709
   • https://github.com/openssl/openssl/commit/bf84721c2548351176e367e6de505792f0118dc6
   • https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393

   and 1 more reference

   Show 8 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Affected versions (publisher)	added	—	OpenSSL
   Description	added	—	Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.
   Weakness type (CWE)	added	—	CWE-770
   Reference	added	—	https://github.com/openssl/openssl/commit/7308946576b12e64b8be53bcf0a120354b2b42bc
   Reference	added	—	https://github.com/openssl/openssl/commit/7c98d79738549df92868e7dd9be4bbf061eed709
   Reference	added	—	https://github.com/openssl/openssl/commit/bf84721c2548351176e367e6de505792f0118dc6
   Reference	added	—	https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393
   Reference	added	—	https://openssl-library.org/news/secadv/20260825.txt

   Source identifier: openssl-security@openssl.org