{"id":"CVE-2026-14456","summary":"Unbounded Memory Growth in QUIC Server Incoming Channel Queue","details":"Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.","modified":"2026-08-15T16:52:29.017325Z","published":"2026-08-13T13:55:52.370Z","database_specific":{"cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14456.json","unresolved_ranges":[{"extracted_events":[{"introduced":"4.0.0"},{"fixed":"4.0.2"},{"introduced":"3.6.0"},{"fixed":"3.6.4"},{"introduced":"3.5.0"},{"fixed":"3.5.8"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"openssl"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/08/13/4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14456.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14456"},{"type":"ADVISORY","url":"https://openssl-library.org/news/secadv/20260813.txt"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"0"},{"fixed":"08e7756c3900bcfd77a720e7b74e27d6e4ed01a9"},{"fixed":"4084152e040329ca0194c4c1750b9b46d00a5b6b"},{"fixed":"f2f1465f2d2e5c61dfeac4d20fd093797d821139"}],"database_specific":{"source":"REFERENCES"}}],"versions":["openssl-3.5.7","openssl-3.6.3","openssl-4.0.1","openssl-4.0.0","openssl-3.5.6","openssl-3.6.2","openssl-4.0.0-beta1","openssl-4.0.0-alpha1","openssl-3.5.5","openssl-3.6.1","3.5-POST-CLANG-FORMAT-WEBKIT","3.5-PRE-CLANG-FORMAT-WEBKIT","3.6-POST-CLANG-FORMAT-WEBKIT","4.0-POST-CLANG-FORMAT-WEBKIT","3.6-PRE-CLANG-FORMAT-WEBKIT","4.0-PRE-CLANG-FORMAT-WEBKIT","openssl-3.6.0","openssl-3.5.4","openssl-3.6.0-beta1","openssl-3.5.3","openssl-3.6.0-alpha1","openssl-3.5.2","openssl-3.5.1","openssl-3.5.0","openssl-3.5.0-beta1","openssl-3.5.0-alpha1","openssl-3.4.0-alpha1","openssl-3.2.0-alpha2","openssl-3.2.0-alpha1","openssl-3.0.0-beta2","openssl-3.0.0-beta1","openssl-3.0.0-alpha17","openssl-3.0.0-alpha16","openssl-3.0.0-alpha15","openssl-3.0.0-alpha14","openssl-3.0.0-alpha13","openssl-3.0.0-alpha12","openssl-3.0.0-alpha11","openssl-3.0.0-alpha10","openssl-3.0.0-alpha9","openssl-3.0.0-alpha8","openssl-3.0.0-alpha7","openssl-3.0.0-alpha6","openssl-3.0.0-alpha5","openssl-3.0.0-alpha4","openssl-3.0.0-alpha3","openssl-3.0.0-alpha2","openssl-3.0.0-alpha1","OpenSSL_1_1_1","OpenSSL_1_1_1-pre9","OpenSSL_1_1_1-pre8","OpenSSL_1_1_1-pre7","OpenSSL_1_1_1-pre6","OpenSSL_1_1_1-pre5","OpenSSL_1_1_1-pre4","OpenSSL_1_1_1-pre3","OpenSSL_1_1_1-pre2","OpenSSL_1_1_1-pre1","OpenSSL_1_1_0-pre6","OpenSSL_1_1_0-pre5","OpenSSL_1_1_0-pre4","OpenSSL_1_1_0-pre3","OpenSSL_1_1_0-pre2","OpenSSL_1_1_0-pre1","master-post-reformat","master-post-auto-reformat","master-pre-auto-reformat","master-pre-reformat","BEFORE_engine","OpenSSL_0_9_6-beta3","OpenSSL_0_9_5a","OpenSSL_0_9_5a-beta2","OpenSSL_0_9_5a-beta1","OpenSSL_0_9_5beta2","OpenSSL_0_9_5beta1","OpenSSL_0_9_4","OpenSSL_0_9_3a","OpenSSL_0_9_3","OpenSSL_0_9_3beta2","OpenSSL_0_9_2b","OpenSSL_0_9_1c"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14456.json","vanir_signatures_modified":"2026-08-15T16:52:29Z","vanir_signatures":[{"source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"file":"ssl/quic/quic_port.c","function":"ossl_quic_port_new"},"deprecated":false,"digest":{"length":484,"function_hash":"152298189674075361688642704687157376484"},"id":"CVE-2026-14456-04fe94a9","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"98313004643330115520943070715735741607","length":331},"id":"CVE-2026-14456-0516d369","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"ssl/quic/quic_impl.c","function":"expect_quic_for_value"}},{"digest":{"line_hashes":["283955993399844781435185125391632170713","66997568548755437359947665907351340716"],"threshold":0.9},"id":"CVE-2026-14456-0f108767","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"file":"include/internal/quic_port.h"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["127447272492966831777046441267912061689","207696824732731389639572734502416992416","263313600752934211079062412412156493849","259639210825664004689443772714126528742","133449213124293360717354397738632833440","178331997951778216193112585036511133093","238390184026904420224440414772506613441","198904153456458740012905179551324085281","249704468801513673027469958307834485141","328203968560099518970369073730078658832","298150452915282983409304347210481431519"],"threshold":0.9},"id":"CVE-2026-14456-1a1968c5","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"ssl/quic/quic_port.c"}},{"deprecated":false,"digest":{"function_hash":"187287412614650548064651686981985965135","length":1270},"id":"CVE-2026-14456-1d1ffab1","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"file":"ssl/quic/quic_impl.c","function":"ossl_quic_get_value_uint"}},{"deprecated":false,"digest":{"function_hash":"187287412614650548064651686981985965135","length":1270},"id":"CVE-2026-14456-2052b66e","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"ssl/quic/quic_impl.c","function":"ossl_quic_get_value_uint"}},{"deprecated":false,"digest":{"function_hash":"235857077784850240524595493989450745790","length":2479},"id":"CVE-2026-14456-2f3ec35c","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"ssl/quic/quic_port.c","function":"port_default_packet_handler"}},{"deprecated":false,"digest":{"function_hash":"235857077784850240524595493989450745790","length":2479},"id":"CVE-2026-14456-32592951","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"file":"ssl/quic/quic_port.c","function":"port_default_packet_handler"}},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"file":"include/internal/quic_port.h"},"deprecated":false,"digest":{"line_hashes":["283955993399844781435185125391632170713","66997568548755437359947665907351340716"],"threshold":0.9},"id":"CVE-2026-14456-4ae0dcb7","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"file":"ssl/quic/quic_port.c"},"deprecated":false,"digest":{"line_hashes":["127447272492966831777046441267912061689","207696824732731389639572734502416992416","263313600752934211079062412412156493849","214179851359437742666655250510188609352","14876342721769314201069611571037310541","164334596802494320768525008913954025657","159955446981634787493935169857845617560","198904153456458740012905179551324085281","249704468801513673027469958307834485141","328203968560099518970369073730078658832","298150452915282983409304347210481431519"],"threshold":0.9},"id":"CVE-2026-14456-4d58ec2d","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"file":"ssl/quic/quic_impl.c","function":"expect_quic_for_value"},"deprecated":false,"digest":{"function_hash":"98313004643330115520943070715735741607","length":331},"id":"CVE-2026-14456-5b211f8c"},{"id":"CVE-2026-14456-78ab08f4","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"file":"ssl/quic/quic_impl.c","function":"expect_quic_for_value"},"deprecated":false,"digest":{"function_hash":"98313004643330115520943070715735741607","length":331}},{"digest":{"function_hash":"140269799276900777752405038766524929506","length":464},"id":"CVE-2026-14456-8db8a54d","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"file":"ssl/quic/quic_port.c","function":"ossl_quic_port_new"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"75318336328397738474977415838708951656","length":433},"id":"CVE-2026-14456-91d7603b","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"file":"ssl/quic/quic_impl.c","function":"ossl_quic_set_value_uint"}},{"source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"file":"ssl/quic/quic_impl.c"},"deprecated":false,"digest":{"line_hashes":["173151801817972153598185864185634163844","337175273814747017794212328477188284766","337476107502584597648425264966286441221","53109360322568627251302881712897159814","49597157704268252314248260180141227454","87708154624208306113405495001684628226","153659877132169705337182315905457463438","277660774243503699899894854579028755949","146731031659043871887801921751293971746","227478790602546851360465222349645972836","198593513978428259675651271683478331098","294669460219480883223449174445239403750","77746380011293567614349931223189732387","48623909572190873751849815751492669569","317330302377552289112813969320299287569","143768461503211377278087979466497572847","123440928055915924103716073270138430986","109444791942819383623229476164103867889"],"threshold":0.9},"id":"CVE-2026-14456-9461466d","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"ssl/quic/quic_impl.c","function":"ossl_quic_set_value_uint"},"deprecated":false,"digest":{"function_hash":"75318336328397738474977415838708951656","length":433},"id":"CVE-2026-14456-9a7f8439"},{"digest":{"line_hashes":["209448326493946565660002278807781826238","134894082087796703171720852004921887731","198348284796264661801711985795887862473","39189457397899046204216189304770462152"],"threshold":0.9},"id":"CVE-2026-14456-a508ca35","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"ssl/quic/quic_port_local.h"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"file":"ssl/quic/quic_port.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["127447272492966831777046441267912061689","207696824732731389639572734502416992416","263313600752934211079062412412156493849","259639210825664004689443772714126528742","133449213124293360717354397738632833440","178331997951778216193112585036511133093","238390184026904420224440414772506613441","198904153456458740012905179551324085281","249704468801513673027469958307834485141","328203968560099518970369073730078658832","298150452915282983409304347210481431519"]},"id":"CVE-2026-14456-a84c7141","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"file":"ssl/quic/quic_impl.c","function":"ossl_quic_get_value_uint"},"deprecated":false,"digest":{"length":1270,"function_hash":"187287412614650548064651686981985965135"},"id":"CVE-2026-14456-b43eac14","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"235857077784850240524595493989450745790","length":2479},"id":"CVE-2026-14456-b702642f","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"file":"ssl/quic/quic_port.c","function":"port_default_packet_handler"}},{"digest":{"function_hash":"75318336328397738474977415838708951656","length":433},"id":"CVE-2026-14456-bb6f48e3","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"function":"ossl_quic_set_value_uint","file":"ssl/quic/quic_impl.c"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["264042437527465570916912235492892512035","235091889006994744792877550066441725866","337476107502584597648425264966286441221","53109360322568627251302881712897159814","49597157704268252314248260180141227454","87708154624208306113405495001684628226","153659877132169705337182315905457463438","277660774243503699899894854579028755949","146731031659043871887801921751293971746","227478790602546851360465222349645972836","198593513978428259675651271683478331098","294669460219480883223449174445239403750","77746380011293567614349931223189732387","48623909572190873751849815751492669569","317330302377552289112813969320299287569","143768461503211377278087979466497572847","123440928055915924103716073270138430986","109444791942819383623229476164103867889"],"threshold":0.9},"id":"CVE-2026-14456-d39db4ea","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"ssl/quic/quic_impl.c"}},{"digest":{"line_hashes":["283955993399844781435185125391632170713","66997568548755437359947665907351340716"],"threshold":0.9},"id":"CVE-2026-14456-d4018fdb","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"include/internal/quic_port.h"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["264042437527465570916912235492892512035","235091889006994744792877550066441725866","337476107502584597648425264966286441221","53109360322568627251302881712897159814","49597157704268252314248260180141227454","87708154624208306113405495001684628226","153659877132169705337182315905457463438","277660774243503699899894854579028755949","146731031659043871887801921751293971746","227478790602546851360465222349645972836","198593513978428259675651271683478331098","294669460219480883223449174445239403750","77746380011293567614349931223189732387","48623909572190873751849815751492669569","317330302377552289112813969320299287569","143768461503211377278087979466497572847","123440928055915924103716073270138430986","109444791942819383623229476164103867889"],"threshold":0.9},"id":"CVE-2026-14456-dc94c3e0","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"file":"ssl/quic/quic_impl.c"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["291625363914164838436188225720507322651","90649636119339903077193033279182033345","118093034802866332811309130124420911763","39189457397899046204216189304770462152"]},"id":"CVE-2026-14456-dd44c922","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139","target":{"file":"ssl/quic/quic_port_local.h"}},{"digest":{"line_hashes":["209448326493946565660002278807781826238","134894082087796703171720852004921887731","198348284796264661801711985795887862473","39189457397899046204216189304770462152"],"threshold":0.9},"id":"CVE-2026-14456-e8d75c43","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b","target":{"file":"ssl/quic/quic_port_local.h"},"deprecated":false},{"id":"CVE-2026-14456-fb97a66d","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9","target":{"file":"ssl/quic/quic_port.c","function":"ossl_quic_port_new"},"deprecated":false,"digest":{"function_hash":"152298189674075361688642704687157376484","length":484}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}