{"id":"CVE-2026-54873","summary":"QUIC STREAM Fragment Metadata DoS","details":"Issue summary: QUIC process may keep memory for QUIC packet\nbuffer for much longer period than necessary.\n\nImpact summary: Remote peer can exploit this vulnerability\nby sending maliciously crafted packets, making the local\nQUIC stack to keep the memory for packet buffers allocated.\nThe time for which the memory remains allocated is entirely\nunder the control of the potentially malicious remote peer.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: To save copy operation from the packet buffer to the\nstream reassemble buffer the QUIC stack leaves the stream data\non the packet buffer waiting to be copied to a buffer provided\nby the local receiving application. The QUIC stack releases\na reference to the packet buffer only after the data are copied\nto the application buffer. This design is more efficient for\nlegitimate data transfers but enables an attacker to allocate a lot\nmore memory than actually required by the data kept in the receiving\nstream buffer.\n\nTo mitigate the vulnerability, the QUIC stack now calculates\nand monitors memory overhead for every stream. The memory overhead\nfor a single stream frame is calculated as a difference between the\nsize of the whole packet that carries the stream frame and the size\nof the stream frame itself. The memory overhead for a single stream\nframe is added to the total (cumulative) memory overhead QUIC stack\nkeeps for each stream. Once the cumulative memory overhead exceeds\n64kB, the QUIC stack moves the stream frame data from the packet\nbuffer to the stream buffer, starting with the next packet received.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.","modified":"2026-10-01T14:13:04.577340621Z","published":"2026-09-29T15:32:16.134Z","database_specific":{"cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54873.json","cna_assigner":"openssl"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54873.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54873"},{"type":"ADVISORY","url":"https://openssl-library.org/news/secadv/20260929.txt"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"11b7b6ea3b65a584e1d31408ed1bdb139465cffd"},{"introduced":"7b371d80d959ec9ab4139d09d78e83c090de9779"},{"introduced":"636dfadc70ce26f2473870570bfd9ec352806b1d"},{"introduced":"98acb6b02839c609ef5b837794e08d906d965335"},{"fixed":"af1775b60dfa141a4ad762585052cabeb9f37e9e"},{"fixed":"c8bd5a57108599ac650bbae77fcabe3109dab2e8"},{"fixed":"45e844fa2a14ec92d146bd8f5778ac130b6625fb"},{"fixed":"e72c946f6f6d94c8ba5119acb25340b7b6b2073f"},{"fixed":"1f643b8bc735487b500a1f68a7fb3a22d5e38e23"},{"fixed":"279e7ee1392af98785746788168749491c74bd53"},{"fixed":"3ea6213e050e938ecbbf8c4eff32bec2736780eb"},{"fixed":"7127fb10888b49711c63128a09e524c0d2d5d0b2"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"4.0.0"},{"fixed":"4.0.3"},{"introduced":"3.6.0"},{"fixed":"3.6.5"},{"introduced":"3.5.0"},{"fixed":"3.5.9"},{"introduced":"3.4.0"},{"fixed":"3.4.8"}]}}],"versions":["openssl-3.4.7","openssl-3.5.8","openssl-3.6.4","openssl-4.0.2","openssl-3.4.6","openssl-3.5.7","openssl-3.6.3","openssl-4.0.1","openssl-4.0.0","openssl-3.4.5","openssl-3.5.6","openssl-3.6.2","openssl-3.4.4","openssl-3.5.5","openssl-3.6.1","3.4-POST-CLANG-FORMAT-WEBKIT","3.4-PRE-CLANG-FORMAT-WEBKIT","3.5-POST-CLANG-FORMAT-WEBKIT","3.5-PRE-CLANG-FORMAT-WEBKIT","3.6-POST-CLANG-FORMAT-WEBKIT","3.6-PRE-CLANG-FORMAT-WEBKIT","openssl-3.6.0","openssl-3.4.3","openssl-3.5.4","openssl-3.5.3","openssl-3.5.2","openssl-3.4.2","openssl-3.5.1","openssl-3.5.0","openssl-3.4.1","openssl-3.4.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-54873.json","vanir_signatures":[{"id":"CVE-2026-54873-0003a238","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"include/internal/quic_predef.h"},"deprecated":false,"digest":{"line_hashes":["271290138531125247165087116873112633162","318717532025969237064028777622139613868","238741492534699677773997491584971814991"],"threshold":0.9}},{"id":"CVE-2026-54873-01abf4fe","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"include/internal/quic_strm_reas.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["255710743085613727868179767442791962190","142025048200188251680615520738610456848","277076384842918731159551310417860245432","1931839233119734837316561413031779486","329916934339407433098694777353761194605","238741611648214424856320911165985608525"]}},{"id":"CVE-2026-54873-04705da6","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"function":"setup_tests","file":"test/quic_stream_test.c"},"deprecated":false,"digest":{"function_hash":"219876714000295019048941404758206782975","length":307}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"function":"ossl_quic_rstream_new","file":"ssl/quic/quic_rstream.c"},"deprecated":false,"digest":{"function_hash":"186164015466830376943284637780140900532","length":219},"id":"CVE-2026-54873-054fe26f"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"ssl/quic/quic_channel.c","function":"ch_init"},"deprecated":false,"digest":{"function_hash":"310385628025669186933875354844006100998","length":5848},"id":"CVE-2026-54873-06d7776b"},{"deprecated":false,"digest":{"function_hash":"186659551696096071546608720608394069932","length":1130},"id":"CVE-2026-54873-06f02ce5","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"ssl/quic/quic_strm_reas.c","function":"new_schunk"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"test/quic_stream_test.c","function":"setup_tests"},"deprecated":false,"digest":{"function_hash":"219876714000295019048941404758206782975","length":307},"id":"CVE-2026-54873-08de95c9"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"test/quic_stream_test.c","function":"test_rstream_pkt"},"deprecated":false,"digest":{"function_hash":"302443306937557867317039641377722003470","length":2592},"id":"CVE-2026-54873-094ffff1"},{"id":"CVE-2026-54873-0c3fc03c","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"ssl/quic/quic_strm_reas.c","function":"keep_schunk_data_on_packet"},"deprecated":false,"digest":{"function_hash":"250943482851294192984725184652642435471","length":86}},{"source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"test/quic_stream_test.c","function":"test_rstream_reorder"},"deprecated":false,"digest":{"length":2345,"function_hash":"187820179910482006466702681209171589293"},"id":"CVE-2026-54873-0eefb65c","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"187820179910482006466702681209171589293","length":2345},"id":"CVE-2026-54873-1122e2a1","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"test/quic_stream_test.c","function":"test_rstream_reorder"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["104730920884563981700045971846566202798","210780274947534315092307544178832174772","147229083484882505939979761405724835263"],"threshold":0.9},"id":"CVE-2026-54873-1146ab87","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"include/internal/quic_predef.h"}},{"deprecated":false,"digest":{"length":7137,"function_hash":"7378263253827058390973923511790982322"},"id":"CVE-2026-54873-12cb961d","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"test/quic_txp_test.c","function":"run_script"}},{"target":{"file":"test/quic_stream_test.c"},"deprecated":false,"digest":{"line_hashes":["310038096191302612560038300056597673586","232729318841241132182390033878557601033","297360098694752431592047494572879367663","135036601534975222854063210317882136178","211385741578854116738156138970176569027","266601144816024972919879389689001918462","152536582375881533043970278771236194641","22893970799582784582180154457342390484","163016579790450511376333867277177705441","6623330209597559170659474318861849301","285122408961874650682096519400768009126","41437229440878653496643620527746562785","158788325084543661759529499082969929684","142394194831709829381929028940338208733","307311432196065155350113125197051360749","73984460987715772519167340623720669482","69795131725308992798024635207649697316","219848000656524879643893394374265176217","230126847222021369380827309364289468208","15671928982841711483698586182242313878","238946688199473346002477783072216368697","137113111670873098538584682330514873206","330546172415224105282799727037652095581","336880814778016835820554689842404942786","83301418729750184692045989749764890057","174902258622329653934297432371092601865","49590073406076679081040264958469622969","205010785487216235610568363077641470293","141059842320322369727907259201928830164","333288337624629760573074044923503152427","94672157934014051698516155539993766026","249298942515075730509519602332789167195","292442691066747040644065960140865915999","139960817591709069838864503299430579885","300795846511202905559381045589489641920","111785010113450132420610667053263580590","75996260759220416167857731153586831911","64600021562269852777081816097466825940","10152158216909494634930436347291490535","164355448892726116005345367987470271194","311560808345091022370278008032382638763","312728143476743824289407870757744180315","66918696927018653052002978933573678365","164391958101283485604803283734016995287","43698028743415795908821857506305525374","124205864254764760662050474385180221301","9905967510035249258375629377615101746","167986288486564953359533329661362714412","170485023972135648166865978798566172264","322767985864209708618647613582951471223","292249648720656100449169105395362991104","47182348259338682716977021844755357734","99431372002037721717638262777606311641","200437311970441935147276354619460232640","295685745413342271690641645340090575524","225497998365262360975968488453117575734","1399241772369291191455203741980404836","147166832741669676118275691344392443186","160340029017376258900417673622390500143","115347484323874237079104523843318089713","245145254449313468491205053162496407948","18678822449282765023207470190146808975","75972261122261302186734732198228806586","154867316090427593509353576400273326530","153736131821460834732758463347729969187","236312652567045810450276210456738841345","129889452546340843139503592341692420398","330110092854497036962261274839046934164","183027383321728415537100543808349079299","75419010847830579183671185683763270816","286601738184406758888215565915275745229","164445941277805167383558932958257090549","293974126660646778079642899695622167096","85705622631325647058580674136524891003","243397078997646437029474738746226261711","209206612113326848329733786963319566219","56762194179127048951214924849467464031","245715090486026015020402070881405255099","56261518412702741874170703889797709034","158491866513075834795725176361284382478","238300552988772764064946854122767483401","29899619120933607693845478781318859874","108198671672907799336949320996399805629","177463065382756784870636949226150982059","265157902471995515502244485472730445757","49532076913158721812084861096678489936","211693719972032125856722237003654308845","6418152096652159148318021448084218237","12307021740705733333072726682154747974","244114742950727221423464698346464058988","39098991041264127133351207933832972262","191634612773420518312046145269042172389","11082938263648344775565715474735540848","189603535166179282421885879708891635829","244245493061919048451871108874656918555","59101104745650311221902555547903205473","238177308508264140110394336365313297774","242692685353347166173532191030682905398","161296780357214908527162445819120092358","269484158198326402381904651429834426553","93416466431778778432009822183738642755","192091355222095868024970002937382549058","14825901965369305286130802936485010644","292121106384805303267721885548781677141","283230670742753353924936155457825891117","249705916672580536491484641565281731881","170784225164125427520374128863033659891","66957429623647110899322897925807801556","68174029065937447134405920776684436249","227378480146427049172611507804350025462","111426544463876408267595522132175433422","240375395797220359027896244532385460248","100676897904310147755719178307438782336","334152836191744512903344467828818365216","311966538473002653531091364792491025947","234676679704719065439474356989154208042","170993015303246513130551692084834588131","272511144598042956256402201345755432761","4882433022492064803457790676781001441","15581239048199790963603505306518382353","324141640284661360611315337372098965901","191359748111736068995231612531673726192","338803344264708879063904888778228011427","128609686985161842045268084890376319149","295743976875057612662558115259854105542","285654328407319533081334944292718404041","250038207793818852300339774350019811686","157824652205669659544413046793771973907","39098991041264127133351207933832972262","111716908130024570048884262717403013970","108937575719759100707692254180048245269","204334135298284033527217439343827886954","310765441807619569443354304281068460061","57545455208853733500043873642459826023","118417630808439161619576031300387211690","7114543838991732632523706110425040691","163204198064297429905149818524830635238","277613695652499843888716971320461859427","328157952371419628806075123797184355301","337093322427912523000619341013007747590","74055718388220807161169942648756719960","125873035063906820081020097919438910851","111410290028330059398314835948057085590","246632070741915507033030947785756034628","278766190564820333323746353537523584821","205546501570482478208458452742586545888","225794001027929801279157561571861761506","153765094423115043606719344354249038111","46532123507895571902000729747631959300","24252409523536893859599217824904527827","286556761383110245654930175338775690314","114822215149110905083694676974872182939","100676897904310147755719178307438782336","99598841823721093597298606233014559964","335633620830761292398911233760101363166","260172900472035567311282561905982496866","328707394610091208549457756850967326795","88502417038601311003768155379383768298","109365791349769637157948064864833457543","293248949289010789889332598322264498785","210617853936783103024080504506698760435","38899996734488930471486197898120821328","265832497687147784321615291187886769386","307349899119420827771004200233698983674","144273289667636979767057315638902205721","138815179710032292851466496711905275558","338193661508963204534175220898358575936"],"threshold":0.9},"id":"CVE-2026-54873-12e896e1","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2"},{"deprecated":false,"digest":{"line_hashes":["158021209202703146910726743953831589788","69021968785156769789724174284599816842","125491674259128209184126642890442764925","314342130742204061248034050178906807843","3496359863607655280980761486577569695","227018701063295309142674222630362090275","266934468990229477904991558435677637780","109382116178949810308940504016127333467","173544838207637550856499869012392325530","102547733206723245400824998322074009258","84738101021862566732891490068499752376","12071559655228178901393709751849861693"],"threshold":0.9},"id":"CVE-2026-54873-1400b1fc","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"ssl/quic/quic_channel.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"test/quic_stream_test.c","function":"setup_tests"},"deprecated":false,"digest":{"function_hash":"219876714000295019048941404758206782975","length":307},"id":"CVE-2026-54873-1404e645"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"test/quic_stream_test.c","function":"test_rstream_simple"},"deprecated":false,"digest":{"function_hash":"325007546468822354825522504777377538129","length":2963},"id":"CVE-2026-54873-16e20755"},{"digest":{"function_hash":"319856698627313868284531399261312313964","length":1457},"id":"CVE-2026-54873-19558ea6","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"function":"test_rstream_pkt_overhead","file":"test/quic_stream_test.c"},"deprecated":false},{"digest":{"line_hashes":["255710743085613727868179767442791962190","142025048200188251680615520738610456848","277076384842918731159551310417860245432","1931839233119734837316561413031779486","329916934339407433098694777353761194605","238741611648214424856320911165985608525"],"threshold":0.9},"id":"CVE-2026-54873-1ed1f669","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"include/internal/quic_strm_reas.h"},"deprecated":false},{"source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"ssl/quic/quic_rstream.c"},"deprecated":false,"digest":{"line_hashes":["113356176128707924877667719104860938880","113908786561843074956634642941507352665","26066413052910037485532243227576717247","65285697697785737815496741303685133387","126769011167610449842607682682337297421","147798832899780386301881938949033104871","199372336283049748949302828022551663467","136351253111642843779602515210387838718","220788080373827259589281847652532077868"],"threshold":0.9},"id":"CVE-2026-54873-2191f6a4","signature_type":"Line","signature_version":"v1"},{"target":{"file":"test/quic_stream_test.c","function":"test_rstream_simple"},"deprecated":false,"digest":{"function_hash":"325007546468822354825522504777377538129","length":2963},"id":"CVE-2026-54873-23d33a41","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb"},{"deprecated":false,"digest":{"function_hash":"232294665454934171297828989695616974548","length":124},"id":"CVE-2026-54873-28618b1e","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"function":"ossl_sframe_set_init","file":"ssl/quic/quic_strm_reas.c"}},{"source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"ssl/quic/quic_channel.c","function":"ch_init_new_stream"},"deprecated":false,"digest":{"length":1251,"function_hash":"217161696146567400234421853879706000114"},"id":"CVE-2026-54873-2a683389","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"include/internal/quic_strm_reas.h"},"deprecated":false,"digest":{"line_hashes":["255710743085613727868179767442791962190","142025048200188251680615520738610456848","277076384842918731159551310417860245432","1931839233119734837316561413031779486","329916934339407433098694777353761194605","238741611648214424856320911165985608525"],"threshold":0.9},"id":"CVE-2026-54873-2cd5b6ac","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"ssl/quic/quic_rstream.c"},"deprecated":false,"digest":{"line_hashes":["113356176128707924877667719104860938880","113908786561843074956634642941507352665","26066413052910037485532243227576717247","65285697697785737815496741303685133387","126769011167610449842607682682337297421","147798832899780386301881938949033104871","199372336283049748949302828022551663467","136351253111642843779602515210387838718","220788080373827259589281847652532077868"],"threshold":0.9},"id":"CVE-2026-54873-2d3e6a11","signature_type":"Line","signature_version":"v1"},{"target":{"file":"ssl/quic/quic_channel.c","function":"ch_init_new_stream"},"deprecated":false,"digest":{"length":1251,"function_hash":"217161696146567400234421853879706000114"},"id":"CVE-2026-54873-2dbab958","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb"},{"digest":{"line_hashes":["113356176128707924877667719104860938880","113908786561843074956634642941507352665","26066413052910037485532243227576717247","65285697697785737815496741303685133387","126769011167610449842607682682337297421","147798832899780386301881938949033104871","199372336283049748949302828022551663467","136351253111642843779602515210387838718","220788080373827259589281847652532077868"],"threshold":0.9},"id":"CVE-2026-54873-2f875fdb","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"ssl/quic/quic_rstream.c"},"deprecated":false},{"digest":{"line_hashes":["310038096191302612560038300056597673586","232729318841241132182390033878557601033","297360098694752431592047494572879367663","135036601534975222854063210317882136178","211385741578854116738156138970176569027","266601144816024972919879389689001918462","152536582375881533043970278771236194641","22893970799582784582180154457342390484","163016579790450511376333867277177705441","6623330209597559170659474318861849301","285122408961874650682096519400768009126","41437229440878653496643620527746562785","158788325084543661759529499082969929684","142394194831709829381929028940338208733","307311432196065155350113125197051360749","73984460987715772519167340623720669482","69795131725308992798024635207649697316","219848000656524879643893394374265176217","230126847222021369380827309364289468208","15671928982841711483698586182242313878","238946688199473346002477783072216368697","137113111670873098538584682330514873206","330546172415224105282799727037652095581","336880814778016835820554689842404942786","83301418729750184692045989749764890057","174902258622329653934297432371092601865","49590073406076679081040264958469622969","205010785487216235610568363077641470293","141059842320322369727907259201928830164","333288337624629760573074044923503152427","94672157934014051698516155539993766026","249298942515075730509519602332789167195","292442691066747040644065960140865915999","139960817591709069838864503299430579885","300795846511202905559381045589489641920","111785010113450132420610667053263580590","75996260759220416167857731153586831911","64600021562269852777081816097466825940","10152158216909494634930436347291490535","164355448892726116005345367987470271194","311560808345091022370278008032382638763","312728143476743824289407870757744180315","66918696927018653052002978933573678365","164391958101283485604803283734016995287","43698028743415795908821857506305525374","124205864254764760662050474385180221301","9905967510035249258375629377615101746","167986288486564953359533329661362714412","170485023972135648166865978798566172264","322767985864209708618647613582951471223","292249648720656100449169105395362991104","47182348259338682716977021844755357734","99431372002037721717638262777606311641","200437311970441935147276354619460232640","295685745413342271690641645340090575524","225497998365262360975968488453117575734","1399241772369291191455203741980404836","147166832741669676118275691344392443186","160340029017376258900417673622390500143","115347484323874237079104523843318089713","245145254449313468491205053162496407948","18678822449282765023207470190146808975","75972261122261302186734732198228806586","154867316090427593509353576400273326530","153736131821460834732758463347729969187","236312652567045810450276210456738841345","129889452546340843139503592341692420398","330110092854497036962261274839046934164","183027383321728415537100543808349079299","75419010847830579183671185683763270816","286601738184406758888215565915275745229","164445941277805167383558932958257090549","293974126660646778079642899695622167096","85705622631325647058580674136524891003","243397078997646437029474738746226261711","209206612113326848329733786963319566219","56762194179127048951214924849467464031","245715090486026015020402070881405255099","56261518412702741874170703889797709034","158491866513075834795725176361284382478","238300552988772764064946854122767483401","29899619120933607693845478781318859874","108198671672907799336949320996399805629","177463065382756784870636949226150982059","265157902471995515502244485472730445757","49532076913158721812084861096678489936","211693719972032125856722237003654308845","6418152096652159148318021448084218237","12307021740705733333072726682154747974","244114742950727221423464698346464058988","39098991041264127133351207933832972262","191634612773420518312046145269042172389","11082938263648344775565715474735540848","189603535166179282421885879708891635829","244245493061919048451871108874656918555","59101104745650311221902555547903205473","238177308508264140110394336365313297774","242692685353347166173532191030682905398","161296780357214908527162445819120092358","269484158198326402381904651429834426553","93416466431778778432009822183738642755","192091355222095868024970002937382549058","14825901965369305286130802936485010644","292121106384805303267721885548781677141","283230670742753353924936155457825891117","249705916672580536491484641565281731881","170784225164125427520374128863033659891","66957429623647110899322897925807801556","68174029065937447134405920776684436249","227378480146427049172611507804350025462","111426544463876408267595522132175433422","240375395797220359027896244532385460248","100676897904310147755719178307438782336","334152836191744512903344467828818365216","311966538473002653531091364792491025947","234676679704719065439474356989154208042","170993015303246513130551692084834588131","272511144598042956256402201345755432761","4882433022492064803457790676781001441","15581239048199790963603505306518382353","324141640284661360611315337372098965901","191359748111736068995231612531673726192","338803344264708879063904888778228011427","128609686985161842045268084890376319149","295743976875057612662558115259854105542","285654328407319533081334944292718404041","250038207793818852300339774350019811686","157824652205669659544413046793771973907","39098991041264127133351207933832972262","111716908130024570048884262717403013970","108937575719759100707692254180048245269","204334135298284033527217439343827886954","310765441807619569443354304281068460061","57545455208853733500043873642459826023","118417630808439161619576031300387211690","7114543838991732632523706110425040691","163204198064297429905149818524830635238","277613695652499843888716971320461859427","328157952371419628806075123797184355301","337093322427912523000619341013007747590","74055718388220807161169942648756719960","125873035063906820081020097919438910851","111410290028330059398314835948057085590","246632070741915507033030947785756034628","278766190564820333323746353537523584821","205546501570482478208458452742586545888","225794001027929801279157561571861761506","153765094423115043606719344354249038111","46532123507895571902000729747631959300","24252409523536893859599217824904527827","286556761383110245654930175338775690314","114822215149110905083694676974872182939","100676897904310147755719178307438782336","99598841823721093597298606233014559964","335633620830761292398911233760101363166","260172900472035567311282561905982496866","328707394610091208549457756850967326795","88502417038601311003768155379383768298","109365791349769637157948064864833457543","293248949289010789889332598322264498785","210617853936783103024080504506698760435","38899996734488930471486197898120821328","265832497687147784321615291187886769386","307349899119420827771004200233698983674","144273289667636979767057315638902205721","138815179710032292851466496711905275558","338193661508963204534175220898358575936"],"threshold":0.9},"id":"CVE-2026-54873-3077dce3","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"test/quic_stream_test.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"ssl/quic/quic_strm_reas.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["303670530528747473622073836424481084976","194931129349681404465845488089319476178","127947875061865058308590235392961860391","122823425973148483260851637369211213620","41865887598991596237633188750279192929","126818867829321683524565432378142323354","245196682163192898183283154685151104896","172691168453432817299390149235217442478","156030084248303586507863440166948907102","58048334697294651323675404076314988035","148334513723953171196728877284659314058","83361735052716079083201897718479405106","255794489465967711065004496153613568812","275906186356103345017122215033289985179","42168597327361054290966244052125781892","52716746730311056749881777381564194456","296875107526211388091198129319392633926","58818695690297628271933119551832927644","105150169022373253935139502628736621450","194394166301977801114197721577191279728","313358159999432105018052249322422998056","182660144877102648698943133899352584276","101044481975470498627898575916623634263","84689792280612821193943093782724312242","6682833314734413718249766006914506461","80228439210178822590707767209992114733","271122150485648787206529946146850948143","177000930345062743297170973185647482875","20293987169399470456149400227702516186","222946708348555521740371180995146973043","43306912884461701668269060868649420517","240970882235785877235128304604332109978","336237187538950886649466635130449612972","189522414952986021205043992765558255351","305812685714457144251681759204107544096","158237495937599524575525415930593194155","47406109548967386882830051373295536353","103226427802402660802150504607220433728","67577760390395108533091545189043234862","329423625943813065243326802255900301172","150312096213360601852946647372185917765","126575844264190312517505477310280637587","153133847416589443028400115726289135810","336063485397069558571027997188060425237","243479108819340186254394992943513488316","69497827284147398279675590774261670173","215525057918734274664412965850665743441","235911387436407173086993620853124531698","180547319353351999561117297894210730489","122782223535734082681108479088968749882","213179671926984772110568693910148689468","185022041285081777703157391618291697743","286680547847518748259499728048994087439","329773192537660695795757492793539307144","40944969520141324871532516422693270592","185039432451181497403882368030790685272","134275561711058587619414728363761342093","322551136240540726829243297739847514882","85787313237560965300978595949601341068","213185050701394585489273262856599738879","123806060228915994392448998899500258845","122971751754625869178999319535558870257","167705526296451932995721452956851035526","269928159475097283691692240640182789170","273264481387978993456012082189904327409","223562178387290612222566263032222739784","271828571355157717661822818170445749981","123758086159275957257442226127846383897","206158565475312199951193756702125576070","256638507027447949364587482350240550535","43036335879936588638796806882325026840","315340321128261241861706037627814723859","79978035544911872682304853057330272032","316427509645898587795209284122590826667","48479522776639681946288493068828093993"]},"id":"CVE-2026-54873-3176d421","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"ssl/quic/quic_strm_reas.c","function":"ossl_sframe_set_init"},"deprecated":false,"digest":{"function_hash":"232294665454934171297828989695616974548","length":124},"id":"CVE-2026-54873-32922b28"},{"deprecated":false,"digest":{"function_hash":"197740053371948354580268635687858154606","length":1251},"id":"CVE-2026-54873-37bc1112","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"function":"ossl_sframe_set_move_offset","file":"ssl/quic/quic_strm_reas.c"}},{"source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"ssl/quic/quic_channel.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["88318223465070462937538492384221167352","62948348153013918861021666346839222309","174358436819636232752578867820752619873","314342130742204061248034050178906807843","3496359863607655280980761486577569695","227018701063295309142674222630362090275","266934468990229477904991558435677637780","109382116178949810308940504016127333467","173544838207637550856499869012392325530","102547733206723245400824998322074009258","84738101021862566732891490068499752376","12071559655228178901393709751849861693"]},"id":"CVE-2026-54873-3a707715","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"test/quic_stream_test.c","function":"test_rstream_pkt_overhead"},"deprecated":false,"digest":{"function_hash":"319856698627313868284531399261312313964","length":1457},"id":"CVE-2026-54873-3f1bfbb0","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"259417034111830916040589728477907695675","length":1337},"id":"CVE-2026-54873-3fe94b02","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"function":"ch_cleanup","file":"ssl/quic/quic_channel.c"}},{"deprecated":false,"digest":{"length":1457,"function_hash":"319856698627313868284531399261312313964"},"id":"CVE-2026-54873-404e0633","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"test/quic_stream_test.c","function":"test_rstream_pkt_overhead"}},{"target":{"file":"test/quic_stream_test.c","function":"test_rstream_random"},"deprecated":false,"digest":{"length":2795,"function_hash":"193731351436764937483392092195846731716"},"id":"CVE-2026-54873-44c4032a","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23"},{"deprecated":false,"digest":{"function_hash":"244125059959012482700344995614383091814","length":5835},"id":"CVE-2026-54873-44d30a8f","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"ssl/quic/quic_channel.c","function":"ch_init"}},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"function":"ossl_sframe_set_move_offset","file":"ssl/quic/quic_strm_reas.c"},"deprecated":false,"digest":{"length":1251,"function_hash":"197740053371948354580268635687858154606"},"id":"CVE-2026-54873-493aa080","signature_type":"Function"},{"source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"test/quic_stream_test.c","function":"test_rstream_simple"},"deprecated":false,"digest":{"function_hash":"325007546468822354825522504777377538129","length":2963},"id":"CVE-2026-54873-49af5cbc","signature_type":"Function","signature_version":"v1"},{"target":{"function":"destroy_schunk","file":"ssl/quic/quic_strm_reas.c"},"deprecated":false,"digest":{"function_hash":"164866666484032143789310022693119141189","length":462},"id":"CVE-2026-54873-49bcd603","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"include/internal/quic_strm_reas.h"},"deprecated":false,"digest":{"line_hashes":["255710743085613727868179767442791962190","142025048200188251680615520738610456848","277076384842918731159551310417860245432","1931839233119734837316561413031779486","329916934339407433098694777353761194605","238741611648214424856320911165985608525"],"threshold":0.9},"id":"CVE-2026-54873-4d67c277","signature_type":"Line"},{"id":"CVE-2026-54873-50e7088a","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"ssl/quic/quic_strm_reas.c","function":"destroy_schunk"},"deprecated":false,"digest":{"function_hash":"164866666484032143789310022693119141189","length":462}},{"deprecated":false,"digest":{"line_hashes":["303670530528747473622073836424481084976","194931129349681404465845488089319476178","127947875061865058308590235392961860391","122823425973148483260851637369211213620","41865887598991596237633188750279192929","126818867829321683524565432378142323354","245196682163192898183283154685151104896","172691168453432817299390149235217442478","156030084248303586507863440166948907102","58048334697294651323675404076314988035","148334513723953171196728877284659314058","83361735052716079083201897718479405106","255794489465967711065004496153613568812","275906186356103345017122215033289985179","42168597327361054290966244052125781892","52716746730311056749881777381564194456","296875107526211388091198129319392633926","58818695690297628271933119551832927644","105150169022373253935139502628736621450","194394166301977801114197721577191279728","313358159999432105018052249322422998056","182660144877102648698943133899352584276","101044481975470498627898575916623634263","84689792280612821193943093782724312242","6682833314734413718249766006914506461","80228439210178822590707767209992114733","271122150485648787206529946146850948143","177000930345062743297170973185647482875","20293987169399470456149400227702516186","222946708348555521740371180995146973043","43306912884461701668269060868649420517","240970882235785877235128304604332109978","336237187538950886649466635130449612972","189522414952986021205043992765558255351","305812685714457144251681759204107544096","158237495937599524575525415930593194155","47406109548967386882830051373295536353","103226427802402660802150504607220433728","67577760390395108533091545189043234862","329423625943813065243326802255900301172","150312096213360601852946647372185917765","126575844264190312517505477310280637587","153133847416589443028400115726289135810","336063485397069558571027997188060425237","243479108819340186254394992943513488316","69497827284147398279675590774261670173","215525057918734274664412965850665743441","235911387436407173086993620853124531698","180547319353351999561117297894210730489","122782223535734082681108479088968749882","213179671926984772110568693910148689468","185022041285081777703157391618291697743","286680547847518748259499728048994087439","329773192537660695795757492793539307144","40944969520141324871532516422693270592","185039432451181497403882368030790685272","134275561711058587619414728363761342093","322551136240540726829243297739847514882","85787313237560965300978595949601341068","213185050701394585489273262856599738879","123806060228915994392448998899500258845","122971751754625869178999319535558870257","167705526296451932995721452956851035526","269928159475097283691692240640182789170","273264481387978993456012082189904327409","223562178387290612222566263032222739784","271828571355157717661822818170445749981","123758086159275957257442226127846383897","206158565475312199951193756702125576070","256638507027447949364587482350240550535","43036335879936588638796806882325026840","315340321128261241861706037627814723859","79978035544911872682304853057330272032","316427509645898587795209284122590826667","48479522776639681946288493068828093993"],"threshold":0.9},"id":"CVE-2026-54873-528693c8","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"ssl/quic/quic_strm_reas.c"}},{"source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"ssl/quic/quic_channel.c","function":"ch_cleanup"},"deprecated":false,"digest":{"function_hash":"145006480166198051644435281163796833136","length":1438},"id":"CVE-2026-54873-557427d4","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"217161696146567400234421853879706000114","length":1251},"id":"CVE-2026-54873-566d1af0","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"function":"ch_init_new_stream","file":"ssl/quic/quic_channel.c"},"deprecated":false},{"digest":{"function_hash":"187820179910482006466702681209171589293","length":2345},"id":"CVE-2026-54873-56f35845","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"test/quic_stream_test.c","function":"test_rstream_reorder"},"deprecated":false},{"id":"CVE-2026-54873-57f7a5c9","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"ssl/quic/quic_strm_reas.c","function":"keep_schunk_data_on_packet"},"deprecated":false,"digest":{"length":86,"function_hash":"250943482851294192984725184652642435471"}},{"id":"CVE-2026-54873-5ae291f9","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"include/internal/quic_stream.h"},"deprecated":false,"digest":{"line_hashes":["183946576356539772125508816298708678101","306481490001092988307445110815684269390","68916960406652029987263242115089426647","199912176266616710859145161299425242524","135868591892513700448779878482849518871","7750429073979201236291477895686521924","339206855495951447204391008819953328729"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"test/quic_stream_test.c"},"deprecated":false,"digest":{"line_hashes":["310038096191302612560038300056597673586","232729318841241132182390033878557601033","297360098694752431592047494572879367663","135036601534975222854063210317882136178","211385741578854116738156138970176569027","266601144816024972919879389689001918462","152536582375881533043970278771236194641","22893970799582784582180154457342390484","163016579790450511376333867277177705441","6623330209597559170659474318861849301","285122408961874650682096519400768009126","41437229440878653496643620527746562785","158788325084543661759529499082969929684","142394194831709829381929028940338208733","307311432196065155350113125197051360749","73984460987715772519167340623720669482","69795131725308992798024635207649697316","219848000656524879643893394374265176217","230126847222021369380827309364289468208","15671928982841711483698586182242313878","238946688199473346002477783072216368697","137113111670873098538584682330514873206","330546172415224105282799727037652095581","336880814778016835820554689842404942786","83301418729750184692045989749764890057","174902258622329653934297432371092601865","49590073406076679081040264958469622969","205010785487216235610568363077641470293","141059842320322369727907259201928830164","333288337624629760573074044923503152427","94672157934014051698516155539993766026","249298942515075730509519602332789167195","292442691066747040644065960140865915999","139960817591709069838864503299430579885","300795846511202905559381045589489641920","111785010113450132420610667053263580590","75996260759220416167857731153586831911","64600021562269852777081816097466825940","10152158216909494634930436347291490535","164355448892726116005345367987470271194","311560808345091022370278008032382638763","312728143476743824289407870757744180315","66918696927018653052002978933573678365","164391958101283485604803283734016995287","43698028743415795908821857506305525374","124205864254764760662050474385180221301","9905967510035249258375629377615101746","167986288486564953359533329661362714412","170485023972135648166865978798566172264","322767985864209708618647613582951471223","292249648720656100449169105395362991104","47182348259338682716977021844755357734","99431372002037721717638262777606311641","200437311970441935147276354619460232640","295685745413342271690641645340090575524","225497998365262360975968488453117575734","1399241772369291191455203741980404836","147166832741669676118275691344392443186","160340029017376258900417673622390500143","115347484323874237079104523843318089713","245145254449313468491205053162496407948","18678822449282765023207470190146808975","75972261122261302186734732198228806586","154867316090427593509353576400273326530","153736131821460834732758463347729969187","236312652567045810450276210456738841345","129889452546340843139503592341692420398","330110092854497036962261274839046934164","183027383321728415537100543808349079299","75419010847830579183671185683763270816","286601738184406758888215565915275745229","164445941277805167383558932958257090549","293974126660646778079642899695622167096","85705622631325647058580674136524891003","243397078997646437029474738746226261711","209206612113326848329733786963319566219","56762194179127048951214924849467464031","245715090486026015020402070881405255099","56261518412702741874170703889797709034","158491866513075834795725176361284382478","238300552988772764064946854122767483401","29899619120933607693845478781318859874","108198671672907799336949320996399805629","177463065382756784870636949226150982059","265157902471995515502244485472730445757","49532076913158721812084861096678489936","211693719972032125856722237003654308845","6418152096652159148318021448084218237","12307021740705733333072726682154747974","244114742950727221423464698346464058988","39098991041264127133351207933832972262","191634612773420518312046145269042172389","11082938263648344775565715474735540848","189603535166179282421885879708891635829","244245493061919048451871108874656918555","59101104745650311221902555547903205473","238177308508264140110394336365313297774","242692685353347166173532191030682905398","161296780357214908527162445819120092358","269484158198326402381904651429834426553","93416466431778778432009822183738642755","192091355222095868024970002937382549058","14825901965369305286130802936485010644","292121106384805303267721885548781677141","283230670742753353924936155457825891117","249705916672580536491484641565281731881","170784225164125427520374128863033659891","66957429623647110899322897925807801556","68174029065937447134405920776684436249","227378480146427049172611507804350025462","111426544463876408267595522132175433422","240375395797220359027896244532385460248","100676897904310147755719178307438782336","334152836191744512903344467828818365216","311966538473002653531091364792491025947","234676679704719065439474356989154208042","170993015303246513130551692084834588131","272511144598042956256402201345755432761","4882433022492064803457790676781001441","15581239048199790963603505306518382353","324141640284661360611315337372098965901","191359748111736068995231612531673726192","338803344264708879063904888778228011427","128609686985161842045268084890376319149","295743976875057612662558115259854105542","285654328407319533081334944292718404041","250038207793818852300339774350019811686","157824652205669659544413046793771973907","39098991041264127133351207933832972262","111716908130024570048884262717403013970","108937575719759100707692254180048245269","204334135298284033527217439343827886954","310765441807619569443354304281068460061","57545455208853733500043873642459826023","118417630808439161619576031300387211690","7114543838991732632523706110425040691","163204198064297429905149818524830635238","277613695652499843888716971320461859427","328157952371419628806075123797184355301","337093322427912523000619341013007747590","74055718388220807161169942648756719960","125873035063906820081020097919438910851","111410290028330059398314835948057085590","246632070741915507033030947785756034628","278766190564820333323746353537523584821","205546501570482478208458452742586545888","225794001027929801279157561571861761506","153765094423115043606719344354249038111","46532123507895571902000729747631959300","24252409523536893859599217824904527827","286556761383110245654930175338775690314","114822215149110905083694676974872182939","100676897904310147755719178307438782336","99598841823721093597298606233014559964","335633620830761292398911233760101363166","260172900472035567311282561905982496866","328707394610091208549457756850967326795","88502417038601311003768155379383768298","109365791349769637157948064864833457543","293248949289010789889332598322264498785","210617853936783103024080504506698760435","38899996734488930471486197898120821328","265832497687147784321615291187886769386","307349899119420827771004200233698983674","144273289667636979767057315638902205721","138815179710032292851466496711905275558","338193661508963204534175220898358575936"],"threshold":0.9},"id":"CVE-2026-54873-5f10c157"},{"id":"CVE-2026-54873-6319123c","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"function":"test_rstream_random","file":"test/quic_stream_test.c"},"deprecated":false,"digest":{"length":2795,"function_hash":"193731351436764937483392092195846731716"}},{"target":{"file":"test/quic_txp_test.c","function":"run_script"},"deprecated":false,"digest":{"function_hash":"7378263253827058390973923511790982322","length":7137},"id":"CVE-2026-54873-63d63c48","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"ssl/quic/quic_channel.c","function":"ch_cleanup"},"deprecated":false,"digest":{"function_hash":"145006480166198051644435281163796833136","length":1438},"id":"CVE-2026-54873-63f73a02","signature_type":"Function"},{"target":{"file":"test/quic_txp_test.c"},"deprecated":false,"digest":{"line_hashes":["109188943025225890716392251902106042842","35944277826344560940824916993963228709","151525722478608339415170955693689057384","208652244383424945931574579353842856667","32120996170541656446452299438628151460","62354766411455591838804764420273569304","147462649147122971863159344961666131724","339997467354897480504164637448615329255","202844930322493820050009338592968043654","138602529619810163631466318666899096879","17043444601849046553135291506872523702","244974711574518600246208867936654524881","98935505437841806396029514177782296118","100507293212045089907754669852185221136","89174359333359515289225705154619782574","169970529746714867650657058704804208720","177907405001509825857334876136428199668","290189892008881198417755069085520856871"],"threshold":0.9},"id":"CVE-2026-54873-67dd5bf0","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb"},{"deprecated":false,"digest":{"line_hashes":["158021209202703146910726743953831589788","69021968785156769789724174284599816842","125491674259128209184126642890442764925","314342130742204061248034050178906807843","3496359863607655280980761486577569695","227018701063295309142674222630362090275","266934468990229477904991558435677637780","109382116178949810308940504016127333467","173544838207637550856499869012392325530","102547733206723245400824998322074009258","84738101021862566732891490068499752376","12071559655228178901393709751849861693"],"threshold":0.9},"id":"CVE-2026-54873-691eaa59","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"ssl/quic/quic_channel.c"}},{"digest":{"line_hashes":["113356176128707924877667719104860938880","113908786561843074956634642941507352665","26066413052910037485532243227576717247","65285697697785737815496741303685133387","126769011167610449842607682682337297421","147798832899780386301881938949033104871","199372336283049748949302828022551663467","136351253111642843779602515210387838718","220788080373827259589281847652532077868"],"threshold":0.9},"id":"CVE-2026-54873-6ac31c1e","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"ssl/quic/quic_rstream.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"ssl/quic/quic_channel_local.h"},"deprecated":false,"digest":{"line_hashes":["211360042034583066576407184200396274745","255199220845102250024613150608752253495","214875993613799589666681537533433171740","231130592181198651195000802811277890467"],"threshold":0.9},"id":"CVE-2026-54873-6e4062b1","signature_type":"Line"},{"target":{"file":"ssl/quic/quic_channel.c","function":"ch_init"},"deprecated":false,"digest":{"function_hash":"244125059959012482700344995614383091814","length":5835},"id":"CVE-2026-54873-75f9be26","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2"},{"source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"test/quic_stream_test.c","function":"test_rstream_pkt"},"deprecated":false,"digest":{"length":2592,"function_hash":"302443306937557867317039641377722003470"},"id":"CVE-2026-54873-765e019d","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"ssl/quic/quic_strm_reas.c","function":"keep_schunk_data_on_packet"},"deprecated":false,"digest":{"length":86,"function_hash":"250943482851294192984725184652642435471"},"id":"CVE-2026-54873-788cbf3a","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"function":"run_script","file":"test/quic_txp_test.c"},"deprecated":false,"digest":{"function_hash":"7378263253827058390973923511790982322","length":7137},"id":"CVE-2026-54873-7b3cc3e9"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"include/internal/quic_stream.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["183946576356539772125508816298708678101","306481490001092988307445110815684269390","68916960406652029987263242115089426647","199912176266616710859145161299425242524","135868591892513700448779878482849518871","7750429073979201236291477895686521924","339206855495951447204391008819953328729"]},"id":"CVE-2026-54873-7c92ef48"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"include/internal/quic_predef.h"},"deprecated":false,"digest":{"line_hashes":["104730920884563981700045971846566202798","210780274947534315092307544178832174772","147229083484882505939979761405724835263"],"threshold":0.9},"id":"CVE-2026-54873-7def4043"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"ssl/quic/quic_strm_reas.c","function":"keep_schunk_data_on_packet"},"deprecated":false,"digest":{"function_hash":"250943482851294192984725184652642435471","length":86},"id":"CVE-2026-54873-87ab69f4","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"include/internal/quic_predef.h"},"deprecated":false,"digest":{"line_hashes":["104730920884563981700045971846566202798","210780274947534315092307544178832174772","147229083484882505939979761405724835263"],"threshold":0.9},"id":"CVE-2026-54873-90749a26","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"ssl/quic/quic_strm_reas.c"},"deprecated":false,"digest":{"line_hashes":["303670530528747473622073836424481084976","194931129349681404465845488089319476178","127947875061865058308590235392961860391","122823425973148483260851637369211213620","41865887598991596237633188750279192929","126818867829321683524565432378142323354","245196682163192898183283154685151104896","172691168453432817299390149235217442478","156030084248303586507863440166948907102","58048334697294651323675404076314988035","148334513723953171196728877284659314058","83361735052716079083201897718479405106","255794489465967711065004496153613568812","275906186356103345017122215033289985179","42168597327361054290966244052125781892","52716746730311056749881777381564194456","296875107526211388091198129319392633926","58818695690297628271933119551832927644","105150169022373253935139502628736621450","194394166301977801114197721577191279728","313358159999432105018052249322422998056","182660144877102648698943133899352584276","101044481975470498627898575916623634263","84689792280612821193943093782724312242","6682833314734413718249766006914506461","80228439210178822590707767209992114733","271122150485648787206529946146850948143","177000930345062743297170973185647482875","20293987169399470456149400227702516186","222946708348555521740371180995146973043","43306912884461701668269060868649420517","240970882235785877235128304604332109978","336237187538950886649466635130449612972","189522414952986021205043992765558255351","305812685714457144251681759204107544096","158237495937599524575525415930593194155","47406109548967386882830051373295536353","103226427802402660802150504607220433728","67577760390395108533091545189043234862","329423625943813065243326802255900301172","150312096213360601852946647372185917765","126575844264190312517505477310280637587","153133847416589443028400115726289135810","336063485397069558571027997188060425237","243479108819340186254394992943513488316","69497827284147398279675590774261670173","215525057918734274664412965850665743441","235911387436407173086993620853124531698","180547319353351999561117297894210730489","122782223535734082681108479088968749882","213179671926984772110568693910148689468","185022041285081777703157391618291697743","286680547847518748259499728048994087439","329773192537660695795757492793539307144","40944969520141324871532516422693270592","185039432451181497403882368030790685272","134275561711058587619414728363761342093","322551136240540726829243297739847514882","85787313237560965300978595949601341068","213185050701394585489273262856599738879","123806060228915994392448998899500258845","122971751754625869178999319535558870257","167705526296451932995721452956851035526","269928159475097283691692240640182789170","273264481387978993456012082189904327409","223562178387290612222566263032222739784","271828571355157717661822818170445749981","123758086159275957257442226127846383897","206158565475312199951193756702125576070","256638507027447949364587482350240550535","43036335879936588638796806882325026840","315340321128261241861706037627814723859","79978035544911872682304853057330272032","316427509645898587795209284122590826667","48479522776639681946288493068828093993"],"threshold":0.9},"id":"CVE-2026-54873-91cdabec"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"ssl/quic/quic_rstream.c","function":"ossl_quic_rstream_new"},"deprecated":false,"digest":{"function_hash":"186164015466830376943284637780140900532","length":219},"id":"CVE-2026-54873-91f576fd","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"232294665454934171297828989695616974548","length":124},"id":"CVE-2026-54873-97c1ac24","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"ssl/quic/quic_strm_reas.c","function":"ossl_sframe_set_init"}},{"deprecated":false,"digest":{"function_hash":"232294665454934171297828989695616974548","length":124},"id":"CVE-2026-54873-986688c8","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"ssl/quic/quic_strm_reas.c","function":"ossl_sframe_set_init"}},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"test/quic_txp_test.c"},"deprecated":false,"digest":{"line_hashes":["109188943025225890716392251902106042842","35944277826344560940824916993963228709","151525722478608339415170955693689057384","208652244383424945931574579353842856667","32120996170541656446452299438628151460","62354766411455591838804764420273569304","147462649147122971863159344961666131724","339997467354897480504164637448615329255","202844930322493820050009338592968043654","138602529619810163631466318666899096879","17043444601849046553135291506872523702","244974711574518600246208867936654524881","98935505437841806396029514177782296118","100507293212045089907754669852185221136","89174359333359515289225705154619782574","169970529746714867650657058704804208720","177907405001509825857334876136428199668","290189892008881198417755069085520856871"],"threshold":0.9},"id":"CVE-2026-54873-99e1711f","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"test/quic_stream_test.c","function":"test_rstream_random"},"deprecated":false,"digest":{"function_hash":"193731351436764937483392092195846731716","length":2795},"id":"CVE-2026-54873-9b96b941","signature_type":"Function"},{"source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"function":"test_rstream_reorder","file":"test/quic_stream_test.c"},"deprecated":false,"digest":{"function_hash":"187820179910482006466702681209171589293","length":2345},"id":"CVE-2026-54873-a023bb65","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":5591,"function_hash":"198619634616240689231495080850820543251"},"id":"CVE-2026-54873-a4e7dffc","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"ssl/quic/quic_channel.c","function":"ch_init"}},{"source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"function":"setup_tests","file":"test/quic_stream_test.c"},"deprecated":false,"digest":{"function_hash":"219876714000295019048941404758206782975","length":307},"id":"CVE-2026-54873-a58e9f94","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"ssl/quic/quic_channel.c","function":"ch_cleanup"},"deprecated":false,"digest":{"function_hash":"134154678843613479184113050556070344833","length":1379},"id":"CVE-2026-54873-a900cbed"},{"target":{"file":"ssl/quic/quic_channel.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["158021209202703146910726743953831589788","69021968785156769789724174284599816842","125491674259128209184126642890442764925","314342130742204061248034050178906807843","3496359863607655280980761486577569695","227018701063295309142674222630362090275","266934468990229477904991558435677637780","109382116178949810308940504016127333467","173544838207637550856499869012392325530","102547733206723245400824998322074009258","84738101021862566732891490068499752376","12071559655228178901393709751849861693"]},"id":"CVE-2026-54873-aa5902c5","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23"},{"id":"CVE-2026-54873-b018462f","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"test/quic_stream_test.c","function":"test_rstream_simple"},"deprecated":false,"digest":{"function_hash":"325007546468822354825522504777377538129","length":2963}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"include/internal/quic_stream.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["183946576356539772125508816298708678101","306481490001092988307445110815684269390","68916960406652029987263242115089426647","199912176266616710859145161299425242524","135868591892513700448779878482849518871","7750429073979201236291477895686521924","339206855495951447204391008819953328729"]},"id":"CVE-2026-54873-b0426c55"},{"id":"CVE-2026-54873-b0523ef9","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"ssl/quic/quic_strm_reas.c","function":"destroy_schunk"},"deprecated":false,"digest":{"function_hash":"164866666484032143789310022693119141189","length":462}},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"ssl/quic/quic_channel.c","function":"ch_init_new_stream"},"deprecated":false,"digest":{"function_hash":"217161696146567400234421853879706000114","length":1251},"id":"CVE-2026-54873-b4409668","signature_type":"Function"},{"id":"CVE-2026-54873-b66400a2","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"function":"chop_range","file":"ssl/quic/quic_strm_reas.c"},"deprecated":false,"digest":{"length":737,"function_hash":"171028329697693189657721028128717805997"}},{"digest":{"function_hash":"171028329697693189657721028128717805997","length":737},"id":"CVE-2026-54873-b7923b64","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"ssl/quic/quic_strm_reas.c","function":"chop_range"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"test/quic_stream_test.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["310038096191302612560038300056597673586","232729318841241132182390033878557601033","297360098694752431592047494572879367663","135036601534975222854063210317882136178","211385741578854116738156138970176569027","266601144816024972919879389689001918462","152536582375881533043970278771236194641","22893970799582784582180154457342390484","163016579790450511376333867277177705441","6623330209597559170659474318861849301","285122408961874650682096519400768009126","41437229440878653496643620527746562785","158788325084543661759529499082969929684","142394194831709829381929028940338208733","307311432196065155350113125197051360749","73984460987715772519167340623720669482","69795131725308992798024635207649697316","219848000656524879643893394374265176217","230126847222021369380827309364289468208","15671928982841711483698586182242313878","238946688199473346002477783072216368697","137113111670873098538584682330514873206","330546172415224105282799727037652095581","336880814778016835820554689842404942786","83301418729750184692045989749764890057","174902258622329653934297432371092601865","49590073406076679081040264958469622969","205010785487216235610568363077641470293","141059842320322369727907259201928830164","333288337624629760573074044923503152427","94672157934014051698516155539993766026","249298942515075730509519602332789167195","292442691066747040644065960140865915999","139960817591709069838864503299430579885","300795846511202905559381045589489641920","111785010113450132420610667053263580590","75996260759220416167857731153586831911","64600021562269852777081816097466825940","10152158216909494634930436347291490535","164355448892726116005345367987470271194","311560808345091022370278008032382638763","312728143476743824289407870757744180315","66918696927018653052002978933573678365","164391958101283485604803283734016995287","43698028743415795908821857506305525374","124205864254764760662050474385180221301","9905967510035249258375629377615101746","167986288486564953359533329661362714412","170485023972135648166865978798566172264","322767985864209708618647613582951471223","292249648720656100449169105395362991104","47182348259338682716977021844755357734","99431372002037721717638262777606311641","200437311970441935147276354619460232640","295685745413342271690641645340090575524","225497998365262360975968488453117575734","1399241772369291191455203741980404836","147166832741669676118275691344392443186","160340029017376258900417673622390500143","115347484323874237079104523843318089713","245145254449313468491205053162496407948","18678822449282765023207470190146808975","75972261122261302186734732198228806586","154867316090427593509353576400273326530","153736131821460834732758463347729969187","236312652567045810450276210456738841345","129889452546340843139503592341692420398","330110092854497036962261274839046934164","183027383321728415537100543808349079299","75419010847830579183671185683763270816","286601738184406758888215565915275745229","164445941277805167383558932958257090549","293974126660646778079642899695622167096","85705622631325647058580674136524891003","243397078997646437029474738746226261711","209206612113326848329733786963319566219","56762194179127048951214924849467464031","245715090486026015020402070881405255099","56261518412702741874170703889797709034","158491866513075834795725176361284382478","238300552988772764064946854122767483401","29899619120933607693845478781318859874","108198671672907799336949320996399805629","177463065382756784870636949226150982059","265157902471995515502244485472730445757","49532076913158721812084861096678489936","211693719972032125856722237003654308845","6418152096652159148318021448084218237","12307021740705733333072726682154747974","244114742950727221423464698346464058988","39098991041264127133351207933832972262","191634612773420518312046145269042172389","11082938263648344775565715474735540848","189603535166179282421885879708891635829","244245493061919048451871108874656918555","59101104745650311221902555547903205473","238177308508264140110394336365313297774","242692685353347166173532191030682905398","161296780357214908527162445819120092358","269484158198326402381904651429834426553","93416466431778778432009822183738642755","192091355222095868024970002937382549058","14825901965369305286130802936485010644","292121106384805303267721885548781677141","283230670742753353924936155457825891117","249705916672580536491484641565281731881","170784225164125427520374128863033659891","66957429623647110899322897925807801556","68174029065937447134405920776684436249","227378480146427049172611507804350025462","111426544463876408267595522132175433422","240375395797220359027896244532385460248","100676897904310147755719178307438782336","334152836191744512903344467828818365216","311966538473002653531091364792491025947","234676679704719065439474356989154208042","170993015303246513130551692084834588131","272511144598042956256402201345755432761","4882433022492064803457790676781001441","15581239048199790963603505306518382353","324141640284661360611315337372098965901","191359748111736068995231612531673726192","338803344264708879063904888778228011427","128609686985161842045268084890376319149","295743976875057612662558115259854105542","285654328407319533081334944292718404041","250038207793818852300339774350019811686","157824652205669659544413046793771973907","39098991041264127133351207933832972262","111716908130024570048884262717403013970","108937575719759100707692254180048245269","204334135298284033527217439343827886954","310765441807619569443354304281068460061","57545455208853733500043873642459826023","118417630808439161619576031300387211690","7114543838991732632523706110425040691","163204198064297429905149818524830635238","277613695652499843888716971320461859427","328157952371419628806075123797184355301","337093322427912523000619341013007747590","74055718388220807161169942648756719960","125873035063906820081020097919438910851","111410290028330059398314835948057085590","246632070741915507033030947785756034628","278766190564820333323746353537523584821","205546501570482478208458452742586545888","225794001027929801279157561571861761506","153765094423115043606719344354249038111","46532123507895571902000729747631959300","24252409523536893859599217824904527827","286556761383110245654930175338775690314","114822215149110905083694676974872182939","100676897904310147755719178307438782336","99598841823721093597298606233014559964","335633620830761292398911233760101363166","260172900472035567311282561905982496866","328707394610091208549457756850967326795","88502417038601311003768155379383768298","109365791349769637157948064864833457543","293248949289010789889332598322264498785","210617853936783103024080504506698760435","38899996734488930471486197898120821328","265832497687147784321615291187886769386","307349899119420827771004200233698983674","144273289667636979767057315638902205721","138815179710032292851466496711905275558","338193661508963204534175220898358575936"]},"id":"CVE-2026-54873-bb360a3f","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["211360042034583066576407184200396274745","255199220845102250024613150608752253495","214875993613799589666681537533433171740","231130592181198651195000802811277890467"],"threshold":0.9},"id":"CVE-2026-54873-bbebb16d","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"ssl/quic/quic_channel_local.h"}},{"deprecated":false,"digest":{"length":1251,"function_hash":"197740053371948354580268635687858154606"},"id":"CVE-2026-54873-bccf286e","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"ssl/quic/quic_strm_reas.c","function":"ossl_sframe_set_move_offset"}},{"source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"ssl/quic/quic_strm_reas.c"},"deprecated":false,"digest":{"line_hashes":["303670530528747473622073836424481084976","194931129349681404465845488089319476178","127947875061865058308590235392961860391","122823425973148483260851637369211213620","41865887598991596237633188750279192929","126818867829321683524565432378142323354","245196682163192898183283154685151104896","172691168453432817299390149235217442478","156030084248303586507863440166948907102","58048334697294651323675404076314988035","148334513723953171196728877284659314058","83361735052716079083201897718479405106","255794489465967711065004496153613568812","275906186356103345017122215033289985179","42168597327361054290966244052125781892","52716746730311056749881777381564194456","296875107526211388091198129319392633926","58818695690297628271933119551832927644","105150169022373253935139502628736621450","194394166301977801114197721577191279728","313358159999432105018052249322422998056","182660144877102648698943133899352584276","101044481975470498627898575916623634263","84689792280612821193943093782724312242","6682833314734413718249766006914506461","80228439210178822590707767209992114733","271122150485648787206529946146850948143","177000930345062743297170973185647482875","20293987169399470456149400227702516186","222946708348555521740371180995146973043","43306912884461701668269060868649420517","240970882235785877235128304604332109978","336237187538950886649466635130449612972","189522414952986021205043992765558255351","305812685714457144251681759204107544096","158237495937599524575525415930593194155","47406109548967386882830051373295536353","103226427802402660802150504607220433728","67577760390395108533091545189043234862","329423625943813065243326802255900301172","150312096213360601852946647372185917765","126575844264190312517505477310280637587","153133847416589443028400115726289135810","336063485397069558571027997188060425237","243479108819340186254394992943513488316","69497827284147398279675590774261670173","215525057918734274664412965850665743441","235911387436407173086993620853124531698","180547319353351999561117297894210730489","122782223535734082681108479088968749882","213179671926984772110568693910148689468","185022041285081777703157391618291697743","286680547847518748259499728048994087439","329773192537660695795757492793539307144","40944969520141324871532516422693270592","185039432451181497403882368030790685272","134275561711058587619414728363761342093","322551136240540726829243297739847514882","85787313237560965300978595949601341068","213185050701394585489273262856599738879","123806060228915994392448998899500258845","122971751754625869178999319535558870257","167705526296451932995721452956851035526","269928159475097283691692240640182789170","273264481387978993456012082189904327409","223562178387290612222566263032222739784","271828571355157717661822818170445749981","123758086159275957257442226127846383897","206158565475312199951193756702125576070","256638507027447949364587482350240550535","43036335879936588638796806882325026840","315340321128261241861706037627814723859","79978035544911872682304853057330272032","316427509645898587795209284122590826667","48479522776639681946288493068828093993"],"threshold":0.9},"id":"CVE-2026-54873-bd0e2e2b","signature_type":"Line","signature_version":"v1"},{"digest":{"length":1130,"function_hash":"186659551696096071546608720608394069932"},"id":"CVE-2026-54873-bea34858","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"ssl/quic/quic_strm_reas.c","function":"new_schunk"},"deprecated":false},{"source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"test/quic_stream_test.c","function":"test_rstream_pkt"},"deprecated":false,"digest":{"length":2592,"function_hash":"302443306937557867317039641377722003470"},"id":"CVE-2026-54873-c12193f3","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-54873-c1ea7f5d","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"ssl/quic/quic_strm_reas.c","function":"ossl_sframe_set_move_offset"},"deprecated":false,"digest":{"function_hash":"197740053371948354580268635687858154606","length":1251}},{"deprecated":false,"digest":{"function_hash":"171028329697693189657721028128717805997","length":737},"id":"CVE-2026-54873-cdfc4d11","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"function":"chop_range","file":"ssl/quic/quic_strm_reas.c"}},{"digest":{"function_hash":"186659551696096071546608720608394069932","length":1130},"id":"CVE-2026-54873-d21da8e4","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"function":"new_schunk","file":"ssl/quic/quic_strm_reas.c"},"deprecated":false},{"digest":{"length":2592,"function_hash":"302443306937557867317039641377722003470"},"id":"CVE-2026-54873-d378b4be","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"test/quic_stream_test.c","function":"test_rstream_pkt"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"ssl/quic/quic_channel_local.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["211360042034583066576407184200396274745","255199220845102250024613150608752253495","169681140157400096384068313331146869770","267880140588470422678022080657033741326"]},"id":"CVE-2026-54873-d8c46c41"},{"target":{"function":"new_schunk","file":"ssl/quic/quic_strm_reas.c"},"deprecated":false,"digest":{"length":1130,"function_hash":"186659551696096071546608720608394069932"},"id":"CVE-2026-54873-dcfe04ba","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"test/quic_txp_test.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["252691839531043047482126423672608792287","148562697559177189732300532417330886468","335307500420586137716390328535793129584","144564051740667309421864961445618633075","32120996170541656446452299438628151460","62354766411455591838804764420273569304","147462649147122971863159344961666131724","339997467354897480504164637448615329255","202844930322493820050009338592968043654","138602529619810163631466318666899096879","17043444601849046553135291506872523702","244974711574518600246208867936654524881","98935505437841806396029514177782296118","100507293212045089907754669852185221136","89174359333359515289225705154619782574","169970529746714867650657058704804208720","177907405001509825857334876136428199668","290189892008881198417755069085520856871"]},"id":"CVE-2026-54873-dd399708","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"function":"test_rstream_random","file":"test/quic_stream_test.c"},"deprecated":false,"digest":{"function_hash":"193731351436764937483392092195846731716","length":2795},"id":"CVE-2026-54873-de8f5f9d","signature_type":"Function"},{"digest":{"line_hashes":["252691839531043047482126423672608792287","148562697559177189732300532417330886468","335307500420586137716390328535793129584","144564051740667309421864961445618633075","32120996170541656446452299438628151460","62354766411455591838804764420273569304","147462649147122971863159344961666131724","339997467354897480504164637448615329255","202844930322493820050009338592968043654","138602529619810163631466318666899096879","17043444601849046553135291506872523702","244974711574518600246208867936654524881","98935505437841806396029514177782296118","100507293212045089907754669852185221136","89174359333359515289225705154619782574","169970529746714867650657058704804208720","177907405001509825857334876136428199668","290189892008881198417755069085520856871"],"threshold":0.9},"id":"CVE-2026-54873-df7eddcf","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23","target":{"file":"test/quic_txp_test.c"},"deprecated":false},{"source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"function":"chop_range","file":"ssl/quic/quic_strm_reas.c"},"deprecated":false,"digest":{"length":737,"function_hash":"171028329697693189657721028128717805997"},"id":"CVE-2026-54873-ed61c5b5","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["183946576356539772125508816298708678101","306481490001092988307445110815684269390","68916960406652029987263242115089426647","199912176266616710859145161299425242524","135868591892513700448779878482849518871","7750429073979201236291477895686521924","339206855495951447204391008819953328729"]},"id":"CVE-2026-54873-f031c1d2","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"file":"include/internal/quic_stream.h"},"deprecated":false},{"id":"CVE-2026-54873-f3147fd3","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"test/quic_stream_test.c","function":"test_rstream_pkt_overhead"},"deprecated":false,"digest":{"function_hash":"319856698627313868284531399261312313964","length":1457}},{"target":{"file":"test/quic_txp_test.c","function":"run_script"},"deprecated":false,"digest":{"length":7137,"function_hash":"7378263253827058390973923511790982322"},"id":"CVE-2026-54873-f6bcee14","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb"},{"digest":{"function_hash":"164866666484032143789310022693119141189","length":462},"id":"CVE-2026-54873-f882d2b3","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2","target":{"function":"destroy_schunk","file":"ssl/quic/quic_strm_reas.c"},"deprecated":false},{"target":{"file":"ssl/quic/quic_rstream.c","function":"ossl_quic_rstream_new"},"deprecated":false,"digest":{"function_hash":"186164015466830376943284637780140900532","length":219},"id":"CVE-2026-54873-fcf84bcd","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2"},{"id":"CVE-2026-54873-ff1bb318","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53","target":{"file":"ssl/quic/quic_channel_local.h"},"deprecated":false,"digest":{"line_hashes":["211360042034583066576407184200396274745","255199220845102250024613150608752253495","214875993613799589666681537533433171740","231130592181198651195000802811277890467"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb","target":{"file":"ssl/quic/quic_rstream.c","function":"ossl_quic_rstream_new"},"deprecated":false,"digest":{"function_hash":"186164015466830376943284637780140900532","length":219},"id":"CVE-2026-54873-ff37b008"}],"vanir_signatures_modified":"2026-10-01T14:13:04Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}