Bug 2481885 (CVE-2026-34183)

Summary:	CVE-2026-34183 openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, csutherl, dpaolell, dsoumis, hyoskim, jclere, jdelft, jupierce, jwon, lgarciaa, mbiarnes, pjindal, plodge, ppalepu, ppostler, prdhamdh, prodsec-dev, rhel-process-autobot, rmaucher, security-response-team, sghai, sidsharm, suppawar, szappis, vchlup, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---	Flags:	hyoskim: needinfo? (prodsec-dev)
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in OpenSSL's QUIC PATH_CHALLENGE handler. A remote attacker can exploit this vulnerability by flooding a QUIC client or server with specially crafted PATH_CHALLENGE frames. This leads to unbounded memory allocation within the local QUIC stack, as the system continuously allocates PATH_RESPONSE frames without them being acknowledged. The primary consequence is a Denial of Service (DoS), causing the affected application to terminate abnormally due to memory exhaustion.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2531015, 2531016, 2531017, 2531018, 2531019
Bug Blocks:
Deadline:	2026-06-09

Description OSIDB Bzimport 2026-05-27 14:05:24 UTC

Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)
Severity: Moderate

Issue summary: Remote peer may exhaust heap memory of the QUIC
server or client by flooding it with packets containing PATH_CHALLENGE
frames.

Impact summary: A malicious remote peer can cause an unbounded
memory allocation which can lead to an abnormal termination of the
application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local
QUIC stack with PATH_CHALLENGE frames. The local QUIC stack
allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives.
The allocated PATH_RESPONSE frame gets freed only when the remote
peer acknowledges reception of the PATH_RESPONSE frame which will
not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by
this issue. The QUIC stack is outside of OpenSSL FIPS module
boundary.

OpenSSL 3.4, 3.5, 3.6 and 4.0 are vulnerable to this issue.

OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

OpenSSL 4.0 users should upgrade to OpenSSL 4.0.1
OpenSSL 3.6 users should upgrade to OpenSSL 3.6.3
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.7
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.6

The issue was reported by Abhinav Agarwal on 18th March 2026.

Fix suggested by Abhinav Agarwal, adapted by Alexandr Nedvedicky.

Comment 2 errata-xmlrpc 2026-06-11 12:31:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:25237 https://access.redhat.com/errata/RHSA-2026:25237

Comment 3 errata-xmlrpc 2026-06-11 12:34:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:25239 https://access.redhat.com/errata/RHSA-2026:25239

Comment 8 Jon Orris 2026-09-24 10:34:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:71542 https://access.redhat.com/errata/RHSA-2026:71542

Comment 9 Jon Orris 2026-10-15 15:41:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:83617 https://access.redhat.com/errata/RHSA-2026:83617