{"id":"CVE-2026-14456","summary":"Unbounded Memory Growth in QUIC Server Incoming Channel Queue","details":"Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.","modified":"2026-10-15T07:25:47.341785507Z","published":"2026-08-13T13:55:52.370Z","related":["ALSA-2026:67154","ALSA-2026:67165","SUSE-SU-2026:23463-1","SUSE-SU-2026:23609-1","SUSE-SU-2026:4039-1","openSUSE-SU-2026:11623-1","openSUSE-SU-2026:21744-1"],"database_specific":{"cna_assigner":"openssl","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14456.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/08/13/4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14456.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14456"},{"type":"ADVISORY","url":"https://openssl-library.org/news/secadv/20260813.txt"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"11b7b6ea3b65a584e1d31408ed1bdb139465cffd"},{"fixed":"f089acdf4bc7ba94a79f4bf6eb7362c3e7d14aa9"},{"introduced":"7b371d80d959ec9ab4139d09d78e83c090de9779"},{"fixed":"d3c1b1169b3569ff3069e5b399f47b2b28e03d79"},{"introduced":"636dfadc70ce26f2473870570bfd9ec352806b1d"},{"fixed":"f4dc4d58b48d346a8270183f89acf826d459b0ca"},{"fixed":"f2f1465f2d2e5c61dfeac4d20fd093797d821139"},{"fixed":"4084152e040329ca0194c4c1750b9b46d00a5b6b"},{"fixed":"08e7756c3900bcfd77a720e7b74e27d6e4ed01a9"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"4.0.0"},{"fixed":"4.0.2"}]},{"range":[{"introduced":"3.6.0"},{"fixed":"3.6.4"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"introduced":"3.5.0"},{"fixed":"3.5.8"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"fixed":"f2f1465f2d2e5c61dfeac4d20fd093797d821139"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"4084152e040329ca0194c4c1750b9b46d00a5b6b"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"08e7756c3900bcfd77a720e7b74e27d6e4ed01a9"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["openssl-3.5.7","openssl-3.6.3","openssl-4.0.1","openssl-4.0.0","openssl-3.5.6","openssl-3.6.2","openssl-3.5.5","openssl-3.6.1","3.5-POST-CLANG-FORMAT-WEBKIT","3.5-PRE-CLANG-FORMAT-WEBKIT","3.6-POST-CLANG-FORMAT-WEBKIT","3.6-PRE-CLANG-FORMAT-WEBKIT","openssl-3.6.0","openssl-3.5.4","openssl-3.5.3","openssl-3.5.2","openssl-3.5.1","openssl-3.5.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-14456.json","vanir_signatures":[{"digest":{"function_hash":"152298189674075361688642704687157376484","length":484},"id":"CVE-2026-14456-04fe94a9","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"file":"ssl/quic/quic_port.c","function":"ossl_quic_port_new"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"ssl/quic/quic_impl.c","function":"expect_quic_for_value"},"deprecated":false,"digest":{"function_hash":"98313004643330115520943070715735741607","length":331},"id":"CVE-2026-14456-0516d369","signature_type":"Function"},{"source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"file":"include/internal/quic_port.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["283955993399844781435185125391632170713","66997568548755437359947665907351340716"]},"id":"CVE-2026-14456-0f108767","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["127447272492966831777046441267912061689","207696824732731389639572734502416992416","263313600752934211079062412412156493849","259639210825664004689443772714126528742","133449213124293360717354397738632833440","178331997951778216193112585036511133093","238390184026904420224440414772506613441","198904153456458740012905179551324085281","249704468801513673027469958307834485141","328203968560099518970369073730078658832","298150452915282983409304347210481431519"],"threshold":0.9},"id":"CVE-2026-14456-1a1968c5","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"ssl/quic/quic_port.c"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"function":"ossl_quic_get_value_uint","file":"ssl/quic/quic_impl.c"},"deprecated":false,"digest":{"length":1270,"function_hash":"187287412614650548064651686981985965135"},"id":"CVE-2026-14456-1d1ffab1"},{"target":{"function":"ossl_quic_get_value_uint","file":"ssl/quic/quic_impl.c"},"deprecated":false,"digest":{"function_hash":"187287412614650548064651686981985965135","length":1270},"id":"CVE-2026-14456-2052b66e","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9"},{"source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"function":"port_default_packet_handler","file":"ssl/quic/quic_port.c"},"deprecated":false,"digest":{"length":2479,"function_hash":"235857077784850240524595493989450745790"},"id":"CVE-2026-14456-2f3ec35c","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"function":"port_default_packet_handler","file":"ssl/quic/quic_port.c"},"deprecated":false,"digest":{"length":2479,"function_hash":"235857077784850240524595493989450745790"},"id":"CVE-2026-14456-32592951","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["283955993399844781435185125391632170713","66997568548755437359947665907351340716"],"threshold":0.9},"id":"CVE-2026-14456-4ae0dcb7","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"file":"include/internal/quic_port.h"}},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"file":"ssl/quic/quic_port.c"},"deprecated":false,"digest":{"line_hashes":["127447272492966831777046441267912061689","207696824732731389639572734502416992416","263313600752934211079062412412156493849","214179851359437742666655250510188609352","14876342721769314201069611571037310541","164334596802494320768525008913954025657","159955446981634787493935169857845617560","198904153456458740012905179551324085281","249704468801513673027469958307834485141","328203968560099518970369073730078658832","298150452915282983409304347210481431519"],"threshold":0.9},"id":"CVE-2026-14456-4d58ec2d","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"function":"expect_quic_for_value","file":"ssl/quic/quic_impl.c"},"deprecated":false,"digest":{"function_hash":"98313004643330115520943070715735741607","length":331},"id":"CVE-2026-14456-5b211f8c","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"file":"ssl/quic/quic_impl.c","function":"expect_quic_for_value"},"deprecated":false,"digest":{"function_hash":"98313004643330115520943070715735741607","length":331},"id":"CVE-2026-14456-78ab08f4","signature_type":"Function"},{"source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"function":"ossl_quic_port_new","file":"ssl/quic/quic_port.c"},"deprecated":false,"digest":{"function_hash":"140269799276900777752405038766524929506","length":464},"id":"CVE-2026-14456-8db8a54d","signature_type":"Function","signature_version":"v1"},{"target":{"file":"ssl/quic/quic_impl.c","function":"ossl_quic_set_value_uint"},"deprecated":false,"digest":{"function_hash":"75318336328397738474977415838708951656","length":433},"id":"CVE-2026-14456-91d7603b","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"file":"ssl/quic/quic_impl.c"},"deprecated":false,"digest":{"line_hashes":["173151801817972153598185864185634163844","337175273814747017794212328477188284766","337476107502584597648425264966286441221","53109360322568627251302881712897159814","49597157704268252314248260180141227454","87708154624208306113405495001684628226","153659877132169705337182315905457463438","277660774243503699899894854579028755949","146731031659043871887801921751293971746","227478790602546851360465222349645972836","198593513978428259675651271683478331098","294669460219480883223449174445239403750","77746380011293567614349931223189732387","48623909572190873751849815751492669569","317330302377552289112813969320299287569","143768461503211377278087979466497572847","123440928055915924103716073270138430986","109444791942819383623229476164103867889"],"threshold":0.9},"id":"CVE-2026-14456-9461466d","signature_type":"Line"},{"id":"CVE-2026-14456-9a7f8439","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"ssl/quic/quic_impl.c","function":"ossl_quic_set_value_uint"},"deprecated":false,"digest":{"function_hash":"75318336328397738474977415838708951656","length":433}},{"digest":{"line_hashes":["209448326493946565660002278807781826238","134894082087796703171720852004921887731","198348284796264661801711985795887862473","39189457397899046204216189304770462152"],"threshold":0.9},"id":"CVE-2026-14456-a508ca35","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"ssl/quic/quic_port_local.h"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"file":"ssl/quic/quic_port.c"},"deprecated":false,"digest":{"line_hashes":["127447272492966831777046441267912061689","207696824732731389639572734502416992416","263313600752934211079062412412156493849","259639210825664004689443772714126528742","133449213124293360717354397738632833440","178331997951778216193112585036511133093","238390184026904420224440414772506613441","198904153456458740012905179551324085281","249704468801513673027469958307834485141","328203968560099518970369073730078658832","298150452915282983409304347210481431519"],"threshold":0.9},"id":"CVE-2026-14456-a84c7141"},{"target":{"file":"ssl/quic/quic_impl.c","function":"ossl_quic_get_value_uint"},"deprecated":false,"digest":{"function_hash":"187287412614650548064651686981985965135","length":1270},"id":"CVE-2026-14456-b43eac14","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139"},{"source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"file":"ssl/quic/quic_port.c","function":"port_default_packet_handler"},"deprecated":false,"digest":{"function_hash":"235857077784850240524595493989450745790","length":2479},"id":"CVE-2026-14456-b702642f","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-14456-bb6f48e3","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"function":"ossl_quic_set_value_uint","file":"ssl/quic/quic_impl.c"},"deprecated":false,"digest":{"function_hash":"75318336328397738474977415838708951656","length":433}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"ssl/quic/quic_impl.c"},"deprecated":false,"digest":{"line_hashes":["264042437527465570916912235492892512035","235091889006994744792877550066441725866","337476107502584597648425264966286441221","53109360322568627251302881712897159814","49597157704268252314248260180141227454","87708154624208306113405495001684628226","153659877132169705337182315905457463438","277660774243503699899894854579028755949","146731031659043871887801921751293971746","227478790602546851360465222349645972836","198593513978428259675651271683478331098","294669460219480883223449174445239403750","77746380011293567614349931223189732387","48623909572190873751849815751492669569","317330302377552289112813969320299287569","143768461503211377278087979466497572847","123440928055915924103716073270138430986","109444791942819383623229476164103867889"],"threshold":0.9},"id":"CVE-2026-14456-d39db4ea"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["283955993399844781435185125391632170713","66997568548755437359947665907351340716"]},"id":"CVE-2026-14456-d4018fdb","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"include/internal/quic_port.h"}},{"id":"CVE-2026-14456-dc94c3e0","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"file":"ssl/quic/quic_impl.c"},"deprecated":false,"digest":{"line_hashes":["264042437527465570916912235492892512035","235091889006994744792877550066441725866","337476107502584597648425264966286441221","53109360322568627251302881712897159814","49597157704268252314248260180141227454","87708154624208306113405495001684628226","153659877132169705337182315905457463438","277660774243503699899894854579028755949","146731031659043871887801921751293971746","227478790602546851360465222349645972836","198593513978428259675651271683478331098","294669460219480883223449174445239403750","77746380011293567614349931223189732387","48623909572190873751849815751492669569","317330302377552289112813969320299287569","143768461503211377278087979466497572847","123440928055915924103716073270138430986","109444791942819383623229476164103867889"],"threshold":0.9}},{"target":{"file":"ssl/quic/quic_port_local.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["291625363914164838436188225720507322651","90649636119339903077193033279182033345","118093034802866332811309130124420911763","39189457397899046204216189304770462152"]},"id":"CVE-2026-14456-dd44c922","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139"},{"digest":{"line_hashes":["209448326493946565660002278807781826238","134894082087796703171720852004921887731","198348284796264661801711985795887862473","39189457397899046204216189304770462152"],"threshold":0.9},"id":"CVE-2026-14456-e8d75c43","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"file":"ssl/quic/quic_port_local.h"},"deprecated":false},{"source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"ssl/quic/quic_port.c","function":"ossl_quic_port_new"},"deprecated":false,"digest":{"function_hash":"152298189674075361688642704687157376484","length":484},"id":"CVE-2026-14456-fb97a66d","signature_type":"Function","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-15T07:25:47Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}