Bug 2543249 (CVE-2026-42772)

Summary: CVE-2026-42772 openssl: openssl: Denial of Service via inefficient QUIC stream reassembly
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, akhatavk, alizardo, anthomas, aos-team-art-private, asdas, csutherl, dpaolell, ehelms, ggainey, jchui, jclere, jdelft, jhe, jpasqual, jupierce, juwatts, ktsao, lgarciaa, mbiarnes, mdellweg, mhulan, nboldt, nmoumoul, oaljalju, osousa, pcreech, pjindal, plodge, ppalepu, ppostler, prdhamdh, psrna, rchan, rhel-process-autobot, sghai, sidsharm, smallamp, suppawar, szappis, tmalecek, vchlup, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in OpenSSL. A remote attacker who establishes a QUIC network connection can cause a Denial of Service (DoS) by sending specially sequenced, out-of-order stream frames. Because the stream reassembly mechanism handles non-sequential data fragments inefficiently, processing these frames forces the server to consume excessive CPU resources. Consequently, an attacker can exhaust system processing capacity using minimal network bandwidth.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-29 15:53:15 UTC 
Issue summary: The QUIC stream reassembly algorithm performance deteriorates
progressively as packets are arriving out of order. The worst case has
a quadratic complexity proportional to the number of stream frames kept in
the buffer for the received stream data.

Impact summary: A remote QUIC peer that completes the handshake can create
a connection-scoped CPU pressure and potentially a Denial of Service using
compliant STREAM frames inside the advertised receive window, with low
attacker bandwidth.

CWE: CWE-407: Inefficient Algorithmic Complexity

Description: OpenSSL manages received QUIC stream fragments using a
doubly-linked list. While it optimizes for append operations (at the end of
the list), it falls back to a head-to-tail linear search for any fragment
that does not immediately follow the current `tail`.

By manipulating the sequence of offsets, an attacker can force the server
to perform O(n^2) operations, consuming excessive CPU time for the
QUIC process.

FIPS impact: no
The FIPS module is not affected as the QUIC implementation is outside of
the OpenSSL FIPS module boundary.