Bug 2531015

Summary: CVE-2026-34183 openssl3: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Patrick Del Bello <pdelbell>
Component: openssl3Assignee: Robert Scheck <redhat-bugzilla>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: epel10CC: dbelyavs, redhat-bugzilla
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["ffd5d9aa-7181-418e-9180-2904febae02b"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2481885    

Description Patrick Del Bello 2026-09-09 15:25:33 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)
Severity: Moderate

Issue summary: Remote peer may exhaust heap memory of the QUIC
server or client by flooding it with packets containing PATH_CHALLENGE
frames.

Impact summary: A malicious remote peer can cause an unbounded
memory allocation which can lead to an abnormal termination of the
application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local
QUIC stack with PATH_CHALLENGE frames. The local QUIC stack
allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives.
The allocated PATH_RESPONSE frame gets freed only when the remote
peer acknowledges reception of the PATH_RESPONSE frame which will
not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by
this issue. The QUIC stack is outside of OpenSSL FIPS module
boundary.

OpenSSL 3.4, 3.5, 3.6 and 4.0 are vulnerable to this issue.

OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.

OpenSSL 4.0 users should upgrade to OpenSSL 4.0.1
OpenSSL 3.6 users should upgrade to OpenSSL 3.6.3
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.7
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.6

The issue was reported by Abhinav Agarwal on 18th March 2026.

Fix suggested by Abhinav Agarwal, adapted by Alexandr Nedvedicky.