{"id":"CVE-2026-18798","summary":"QUIC Server May Trigger Double Free When Processing INITIAL Packet","details":"Issue summary: QUIC server may double free QRX (QUIC record layer RX) object\nwhen channel creation fails for initial packet.\n\nImpact summary: Double free leads to heap corruption, which typically results in \ntermination of QUIC server process, leading to Denial of Service. There is so\nfar no evidence that this double free is exploitable for remote code execution,\nthus it is considered highly improbable.\n\nCWE: CWE-415: Double Free\n\nDescription: In order to validate initial packet, OpenSSL QUIC stack default\npacket handler (port_default_packet_handler()) creates a so-called QRX object.\nIf the initial packet validates successfully with QRX object, the default packet\nhandler proceeds to channel (connection object) creation. The QRX object used\nfor packet validation is passed to port_bind_channel(), so it becomes part of\nthe newly created connection. If port_bind_channel() fails, then it also frees\nthe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()\ndetects the failure and proceeds to the error branch, where the same QRX object is\nfreed for the second time.\n\nThe failure in port_bind_channel() function can be induced with a relatively\nlow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet\ncarries DCID (destination connection ID) which is shorter than 8 bytes, then\nport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()\ndetects that the DCID has invalid length.\n\nFIPS impact: no\nThe FIPS module is not affected, as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.","modified":"2026-08-30T08:08:45.171901Z","published":"2026-08-25T12:59:04.715Z","related":["openSUSE-SU-2026:11623-1"],"database_specific":{"cna_assigner":"openssl","cwe_ids":["CWE-415"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18798.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18798.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18798"},{"type":"ADVISORY","url":"https://openssl-library.org/news/secadv/20260825.txt"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"11b7b6ea3b65a584e1d31408ed1bdb139465cffd"},{"introduced":"7b371d80d959ec9ab4139d09d78e83c090de9779"},{"introduced":"636dfadc70ce26f2473870570bfd9ec352806b1d"},{"fixed":"f089acdf4bc7ba94a79f4bf6eb7362c3e7d14aa9"},{"fixed":"d3c1b1169b3569ff3069e5b399f47b2b28e03d79"},{"fixed":"f4dc4d58b48d346a8270183f89acf826d459b0ca"},{"fixed":"70cebd74d3592f5272945501b58a60374c4e13af"},{"fixed":"967582d5037f01a26b6d19beae19af62a1b15c3c"},{"fixed":"a14a1deac403522fbeafabcb198503cf6caa7dc4"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"4.0.0"},{"fixed":"4.0.2"},{"introduced":"3.6.0"},{"fixed":"3.6.4"},{"introduced":"3.5.0"},{"fixed":"3.5.8"}]}}],"versions":["openssl-3.5.7","openssl-3.6.3","openssl-4.0.1","openssl-4.0.0","openssl-3.5.6","openssl-3.6.2","openssl-3.5.5","openssl-3.6.1","3.5-POST-CLANG-FORMAT-WEBKIT","3.5-PRE-CLANG-FORMAT-WEBKIT","3.6-POST-CLANG-FORMAT-WEBKIT","3.6-PRE-CLANG-FORMAT-WEBKIT","openssl-3.6.0","openssl-3.5.4","openssl-3.5.3","openssl-3.5.2","openssl-3.5.1","openssl-3.5.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-18798.json","vanir_signatures_modified":"2026-08-30T08:08:45Z","vanir_signatures":[{"deprecated":false,"digest":{"length":2615,"function_hash":"119661022288608872337053385001810430410"},"id":"CVE-2026-18798-037f5e7d","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af","target":{"file":"ssl/quic/quic_port.c","function":"port_default_packet_handler"}},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c","target":{"file":"ssl/quic/quic_record_rx.c","function":"ossl_qrx_free"},"deprecated":false,"digest":{"function_hash":"22098268924943819192369195393972704405","length":354},"id":"CVE-2026-18798-066c83d7","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af","target":{"file":"ssl/quic/quic_record_rx.c","function":"ossl_qrx_free"},"deprecated":false,"digest":{"length":354,"function_hash":"22098268924943819192369195393972704405"},"id":"CVE-2026-18798-0ab21940","signature_type":"Function"},{"digest":{"function_hash":"278229109545813161100669326983236309295","length":1145},"id":"CVE-2026-18798-0c70e669","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4","target":{"file":"ssl/quic/quic_port.c","function":"port_make_channel"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["208902964327613256665722212816883545306","168705829777658789221653880128849717094","210803577515893423855789188413458733979","110419929409533007772932125034720561892"],"threshold":0.9},"id":"CVE-2026-18798-0ecc1827","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af","target":{"file":"include/internal/quic_record_rx.h"}},{"deprecated":false,"digest":{"line_hashes":["302879372378965209241127772336534167237","130238884920379188540488167048822504454","330207632956552300617290968274893389948","283326832369827515539052514554886929244","257640999106482251919159564972131266542","153854344195692108990699925678087668672","62586097709506568834007152022439390509","173518026399295534122453031699044915659","220634060757816898941916019721213667691","223524205258166407385468661546071949981","222946259652319367688494177975061699616","72670394715812589996853645331114568562","137470818321897555349654402419838688221","207662393859085063259291601271933282184","218299489990340480259835734542321448007","240317816919370294957979146550487012709","212026193598741128301320168283450414431","34143215434456572105578398708501231014","326015943171566215203692928729706512749"],"threshold":0.9},"id":"CVE-2026-18798-2070d7ab","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af","target":{"file":"ssl/quic/quic_record_rx.c"}},{"target":{"file":"ssl/quic/quic_port.c"},"deprecated":false,"digest":{"line_hashes":["240914215017186294226142347683450560430","280970976319603350876489102695075276506","201986303530912982414291591802365311366","122291995788913186127284991730518884870","140555896382094549831877743456149820185","237880501100998406062913149365496300198","159158186188606617066208819564524086450","124238564755588710792742426856006837978","268649481035552095078005168417860446914","209826582590895312080169486369012490220","235027939658370141158260377565341659043","307072972395173058556558210126024087902","324147777958056258312995721152071058908","12877131261402896114707315481900631452","105462976482951132750775355860472258301","313477172295911032488179911192765989282","130866503485943027730033959724675060039","332346663866528931114932571334699711744","237792002322964775224209299238072678476","173732613777798237107145513465431378663","295258306022471118505516780878668803105","21522683304453636071264107453376365603","136749429072618104842807563055438908029","205785115756177143566581998286125909799","73130217147480022529255084414845075909","152174808315748598615916452823248366676"],"threshold":0.9},"id":"CVE-2026-18798-3f7f28be","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4"},{"digest":{"function_hash":"134414923595574163358056114025314632417","length":900},"id":"CVE-2026-18798-47d88aa6","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c","target":{"function":"port_make_channel","file":"ssl/quic/quic_port.c"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4","target":{"file":"ssl/quic/quic_port.c","function":"port_default_packet_handler"},"deprecated":false,"digest":{"function_hash":"119661022288608872337053385001810430410","length":2615},"id":"CVE-2026-18798-5168b3dd"},{"id":"CVE-2026-18798-715d661b","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c","target":{"file":"ssl/quic/quic_record_rx.c","function":"ossl_qrx_new"},"deprecated":false,"digest":{"function_hash":"101734434527069342192152941593303362747","length":613}},{"deprecated":false,"digest":{"function_hash":"22098268924943819192369195393972704405","length":354},"id":"CVE-2026-18798-8d5969a3","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4","target":{"function":"ossl_qrx_free","file":"ssl/quic/quic_record_rx.c"}},{"source":"https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4","target":{"file":"ssl/quic/quic_record_rx.c","function":"ossl_qrx_new"},"deprecated":false,"digest":{"function_hash":"101734434527069342192152941593303362747","length":613},"id":"CVE-2026-18798-8e5340e4","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-18798-99a99243","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c","target":{"file":"ssl/quic/quic_port.c","function":"port_default_packet_handler"},"deprecated":false,"digest":{"function_hash":"119661022288608872337053385001810430410","length":2615}},{"deprecated":false,"digest":{"line_hashes":["240914215017186294226142347683450560430","280970976319603350876489102695075276506","290089461392437232983322503000153841344","128709766597416488715346669670240343554","219904224256561849095734172445101509905","237880501100998406062913149365496300198","159158186188606617066208819564524086450","124238564755588710792742426856006837978","268649481035552095078005168417860446914","209826582590895312080169486369012490220","235027939658370141158260377565341659043","307072972395173058556558210126024087902","324147777958056258312995721152071058908","12877131261402896114707315481900631452","105462976482951132750775355860472258301","313477172295911032488179911192765989282","130866503485943027730033959724675060039","332346663866528931114932571334699711744","237792002322964775224209299238072678476","173732613777798237107145513465431378663","295258306022471118505516780878668803105","21522683304453636071264107453376365603","136749429072618104842807563055438908029","205785115756177143566581998286125909799","73130217147480022529255084414845075909","152174808315748598615916452823248366676"],"threshold":0.9},"id":"CVE-2026-18798-a39f26d1","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c","target":{"file":"ssl/quic/quic_port.c"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["208902964327613256665722212816883545306","168705829777658789221653880128849717094","210803577515893423855789188413458733979","110419929409533007772932125034720561892"]},"id":"CVE-2026-18798-ae1b4b2e","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4","target":{"file":"include/internal/quic_record_rx.h"}},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4","target":{"file":"ssl/quic/quic_record_rx.c"},"deprecated":false,"digest":{"line_hashes":["302879372378965209241127772336534167237","130238884920379188540488167048822504454","330207632956552300617290968274893389948","283326832369827515539052514554886929244","257640999106482251919159564972131266542","153854344195692108990699925678087668672","62586097709506568834007152022439390509","173518026399295534122453031699044915659","220634060757816898941916019721213667691","223524205258166407385468661546071949981","222946259652319367688494177975061699616","72670394715812589996853645331114568562","137470818321897555349654402419838688221","207662393859085063259291601271933282184","218299489990340480259835734542321448007","240317816919370294957979146550487012709","212026193598741128301320168283450414431","34143215434456572105578398708501231014","326015943171566215203692928729706512749"],"threshold":0.9},"id":"CVE-2026-18798-d4087c5c","signature_type":"Line"},{"id":"CVE-2026-18798-d4595646","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c","target":{"file":"ssl/quic/quic_record_rx.c"},"deprecated":false,"digest":{"line_hashes":["302879372378965209241127772336534167237","130238884920379188540488167048822504454","330207632956552300617290968274893389948","283326832369827515539052514554886929244","257640999106482251919159564972131266542","153854344195692108990699925678087668672","62586097709506568834007152022439390509","173518026399295534122453031699044915659","220634060757816898941916019721213667691","223524205258166407385468661546071949981","222946259652319367688494177975061699616","72670394715812589996853645331114568562","137470818321897555349654402419838688221","207662393859085063259291601271933282184","218299489990340480259835734542321448007","240317816919370294957979146550487012709","212026193598741128301320168283450414431","34143215434456572105578398708501231014","326015943171566215203692928729706512749"],"threshold":0.9}},{"id":"CVE-2026-18798-db240794","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af","target":{"file":"ssl/quic/quic_port.c","function":"port_make_channel"},"deprecated":false,"digest":{"function_hash":"134414923595574163358056114025314632417","length":900}},{"source":"https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af","target":{"function":"ossl_qrx_new","file":"ssl/quic/quic_record_rx.c"},"deprecated":false,"digest":{"length":613,"function_hash":"101734434527069342192152941593303362747"},"id":"CVE-2026-18798-e7bff048","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af","target":{"file":"ssl/quic/quic_port.c"},"deprecated":false,"digest":{"line_hashes":["240914215017186294226142347683450560430","280970976319603350876489102695075276506","290089461392437232983322503000153841344","128709766597416488715346669670240343554","219904224256561849095734172445101509905","237880501100998406062913149365496300198","159158186188606617066208819564524086450","124238564755588710792742426856006837978","268649481035552095078005168417860446914","209826582590895312080169486369012490220","235027939658370141158260377565341659043","307072972395173058556558210126024087902","324147777958056258312995721152071058908","12877131261402896114707315481900631452","105462976482951132750775355860472258301","313477172295911032488179911192765989282","130866503485943027730033959724675060039","332346663866528931114932571334699711744","237792002322964775224209299238072678476","173732613777798237107145513465431378663","295258306022471118505516780878668803105","21522683304453636071264107453376365603","136749429072618104842807563055438908029","205785115756177143566581998286125909799","73130217147480022529255084414845075909","152174808315748598615916452823248366676"],"threshold":0.9},"id":"CVE-2026-18798-f7647455"},{"digest":{"line_hashes":["208902964327613256665722212816883545306","168705829777658789221653880128849717094","210803577515893423855789188413458733979","110419929409533007772932125034720561892"],"threshold":0.9},"id":"CVE-2026-18798-fd5c343a","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c","target":{"file":"include/internal/quic_record_rx.h"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}