{"id":"CVE-2026-34183","summary":"Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler","details":"Issue summary: Remote peer may exhaust heap memory of the QUIC\nserver or client by flooding it with packets containing PATH_CHALLENGE\nframes.\n\nImpact summary: A malicious remote peer can cause an unbounded\nmemory allocation which can lead to an abnormal termination of the\napplication acting as a QUIC client or server and a Denial of Service.\n\nA remote peer may exhaust heap memory by flooding the local\nQUIC stack with PATH_CHALLENGE frames. The local QUIC stack\nallocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives.\nThe allocated PATH_RESPONSE frame gets freed only when the remote\npeer acknowledges reception of the PATH_RESPONSE frame which will\nnot be done by a malicious peer.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by\nthis issue. The QUIC stack is outside of OpenSSL FIPS module\nboundary.","modified":"2026-07-26T03:40:44.274305Z","published":"2026-06-09T16:03:23.623Z","related":["ALSA-2026:25237","ALSA-2026:25239","CGA-vgvw-4grv-5fjc","SUSE-SU-2026:22251-1","SUSE-SU-2026:22315-1","SUSE-SU-2026:2648-1","openSUSE-SU-2026:11023-1","openSUSE-SU-2026:21005-1"],"database_specific":{"cna_assigner":"openssl","cwe_ids":["CWE-1325"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34183.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34183.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34183"},{"type":"ADVISORY","url":"https://openssl-library.org/news/secadv/20260609.txt"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"98acb6b02839c609ef5b837794e08d906d965335"},{"fixed":"c5ea1cc227fd60afae8ac4b9438690bbe4888f79"},{"introduced":"636dfadc70ce26f2473870570bfd9ec352806b1d"},{"fixed":"8cf17aaeb4599f8af87fefd810b5b5fee90fe69e"},{"introduced":"7b371d80d959ec9ab4139d09d78e83c090de9779"},{"fixed":"aae016bfd52fcad2bc9657c2c782cfdf73b1ed5f"},{"introduced":"11b7b6ea3b65a584e1d31408ed1bdb139465cffd"},{"fixed":"5b306efb0b3779dfdd0803b4afc9d08c91f11517"},{"fixed":"7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"},{"fixed":"d2e9efbe4900a373227deb136e8665401404ffac"},{"fixed":"fbaa83859c01ad64f497b757aaf51be7d05ed9eb"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.4.0"},{"fixed":"3.4.6"},{"introduced":"3.5.0"},{"fixed":"3.5.7"},{"introduced":"3.6.0"},{"fixed":"3.6.3"},{"introduced":"4.0.0-NA"},{"last_affected":"4.0.0-NA"}]}}],"versions":["4.0.0-NA","openssl-4.0.0","openssl-3.4.5","openssl-3.5.6","openssl-3.6.2","openssl-3.4.4","openssl-3.5.5","openssl-3.6.1","3.4-POST-CLANG-FORMAT-WEBKIT","3.4-PRE-CLANG-FORMAT-WEBKIT","3.5-POST-CLANG-FORMAT-WEBKIT","3.5-PRE-CLANG-FORMAT-WEBKIT","3.6-POST-CLANG-FORMAT-WEBKIT","3.6-PRE-CLANG-FORMAT-WEBKIT","openssl-3.6.0","openssl-3.4.3","openssl-3.5.4","openssl-3.5.3","openssl-3.5.2","openssl-3.4.2","openssl-3.5.1","openssl-3.5.0","openssl-3.4.1","openssl-3.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34183.json","vanir_signatures_modified":"2026-07-26T03:40:44Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"336641234594347542091119058144224198347","length":720},"id":"CVE-2026-34183-02e4c251","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb","target":{"file":"ssl/quic/quic_rx_depack.c","function":"ossl_quic_handle_frames"}},{"id":"CVE-2026-34183-12c0a834","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517","target":{"file":"include/internal/quic_cfq.h"},"deprecated":false,"digest":{"line_hashes":["17619631997647045611390242832180276565","133467912692424401758276322394205795573"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac","target":{"file":"include/internal/quic_cfq.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["17619631997647045611390242832180276565","133467912692424401758276322394205795573"]},"id":"CVE-2026-34183-167228f5","signature_type":"Line"},{"deprecated":false,"digest":{"length":3008,"function_hash":"161994472543430899723538006510755481804"},"id":"CVE-2026-34183-17067a60","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac","target":{"file":"ssl/quic/quic_txp.c","function":"txp_pkt_commit"}},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac","target":{"file":"include/internal/quic_channel.h"},"deprecated":false,"digest":{"line_hashes":["108747366242345647591197637812625952066","250750693307312180336287694911741365309"],"threshold":0.9},"id":"CVE-2026-34183-1deb490c","signature_type":"Line"},{"digest":{"line_hashes":["150569026360306455806206181791882731795","15934604103806316593464069826954878768","177464121719511158010434828964609689376"],"threshold":0.9},"id":"CVE-2026-34183-26982dc0","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac","target":{"file":"ssl/quic/quic_channel.c"},"deprecated":false},{"source":"https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac","target":{"file":"ssl/quic/quic_txp.c"},"deprecated":false,"digest":{"line_hashes":["45128711054467000430936538387457324988","149330818967290373335056504883011268937","165174572031812930150208362394930086547"],"threshold":0.9},"id":"CVE-2026-34183-2f762fb0","signature_type":"Line","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["317034173942351296182659702637745233270","288307443070895623675948612950410069886"]},"id":"CVE-2026-34183-391e53c9","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517","target":{"file":"include/internal/quic_fifd.h"},"deprecated":false},{"source":"https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac","target":{"file":"ssl/quic/quic_txp.c","function":"txp_pkt_commit"},"deprecated":false,"digest":{"function_hash":"161994472543430899723538006510755481804","length":3008},"id":"CVE-2026-34183-3975297b","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb","target":{"file":"include/internal/quic_fifd.h"},"deprecated":false,"digest":{"line_hashes":["317034173942351296182659702637745233270","288307443070895623675948612950410069886"],"threshold":0.9},"id":"CVE-2026-34183-3c651efe","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-34183-3f802283","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac","target":{"file":"ssl/quic/quic_rx_depack.c","function":"depack_do_frame_path_challenge"},"deprecated":false,"digest":{"function_hash":"132626122019583303694968741362670635918","length":872}},{"digest":{"line_hashes":["125836126259094406777805326932883223191","60821833181468548777893932459539788475","296667982168421279828153649100201152846"],"threshold":0.9},"id":"CVE-2026-34183-413bbad9","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517","target":{"file":"ssl/quic/quic_channel.c"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["55439535173121503976817818931592893497","127204818329041298298294467612191537359","50310224725132401245228365000792676619","241198617938439281436044265979510326836"],"threshold":0.9},"id":"CVE-2026-34183-4a8d14aa","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb","target":{"file":"ssl/quic/quic_cfq.c"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac","target":{"file":"ssl/quic/quic_cfq.c"},"deprecated":false,"digest":{"line_hashes":["55439535173121503976817818931592893497","127204818329041298298294467612191537359","50310224725132401245228365000792676619","241198617938439281436044265979510326836"],"threshold":0.9},"id":"CVE-2026-34183-53d4505f"},{"id":"CVE-2026-34183-55b243af","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac","target":{"file":"ssl/quic/quic_channel_local.h"},"deprecated":false,"digest":{"line_hashes":["119843563940857191665238197175665795421","52907295179543340816464288799123237651","252177752591175264532377411353109894318","213320775335163836004746971640321525448","74619020260506909693096693632824749486","249561572208919266938070880573235238345","211360042034583066576407184200396274745","292917114161060296173144304212059980858","60503260939705954420693585677802080872","298018461312991046913517634245101399641"],"threshold":0.9}},{"source":"https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac","target":{"function":"depack_do_frame_path_challenge","file":"ssl/quic/quic_rx_depack.c"},"deprecated":false,"digest":{"length":872,"function_hash":"132626122019583303694968741362670635918"},"id":"CVE-2026-34183-5755a27a","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["17619631997647045611390242832180276565","133467912692424401758276322394205795573"],"threshold":0.9},"id":"CVE-2026-34183-5e6198dd","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac","target":{"file":"include/internal/quic_cfq.h"}},{"deprecated":false,"digest":{"line_hashes":["125836126259094406777805326932883223191","60821833181468548777893932459539788475","296667982168421279828153649100201152846"],"threshold":0.9},"id":"CVE-2026-34183-67830b3d","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb","target":{"file":"ssl/quic/quic_channel.c"}},{"deprecated":false,"digest":{"line_hashes":["19585554247427260409879349293836484982","320207407732071289639035327487100772559","199989101668011552648760252046406491392"],"threshold":0.9},"id":"CVE-2026-34183-68849ef7","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb","target":{"file":"include/internal/quic_channel.h"}},{"id":"CVE-2026-34183-792245f2","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517","target":{"file":"ssl/quic/quic_channel_local.h"},"deprecated":false,"digest":{"line_hashes":["246818849505342602955063588459453274592","142039821623459103211929688998001696677","249537960300591757396437299874197582936","201112550313325936933021758451806127378","312972453870536606714670309149540804956","276790711039654102130544296735538223365","152010330387736881777572324036182495290","211360042034583066576407184200396274745","292917114161060296173144304212059980858","60503260939705954420693585677802080872","298018461312991046913517634245101399641"],"threshold":0.9}},{"source":"https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb","target":{"file":"ssl/quic/quic_rx_depack.c","function":"depack_do_frame_path_challenge"},"deprecated":false,"digest":{"function_hash":"132626122019583303694968741362670635918","length":872},"id":"CVE-2026-34183-7f970c96","signature_type":"Function","signature_version":"v1"},{"target":{"file":"include/internal/quic_cfq.h"},"deprecated":false,"digest":{"line_hashes":["17619631997647045611390242832180276565","133467912692424401758276322394205795573"],"threshold":0.9},"id":"CVE-2026-34183-8153717f","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"},{"deprecated":false,"digest":{"line_hashes":["246818849505342602955063588459453274592","142039821623459103211929688998001696677","249537960300591757396437299874197582936","201112550313325936933021758451806127378","312972453870536606714670309149540804956","276790711039654102130544296735538223365","152010330387736881777572324036182495290","211360042034583066576407184200396274745","292917114161060296173144304212059980858","60503260939705954420693585677802080872","298018461312991046913517634245101399641"],"threshold":0.9},"id":"CVE-2026-34183-8c9b2640","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb","target":{"file":"ssl/quic/quic_channel_local.h"}},{"digest":{"line_hashes":["19585554247427260409879349293836484982","320207407732071289639035327487100772559","199989101668011552648760252046406491392"],"threshold":0.9},"id":"CVE-2026-34183-9e3db152","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517","target":{"file":"include/internal/quic_channel.h"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["45128711054467000430936538387457324988","149330818967290373335056504883011268937","165174572031812930150208362394930086547"],"threshold":0.9},"id":"CVE-2026-34183-a6e57193","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517","target":{"file":"ssl/quic/quic_txp.c"}},{"deprecated":false,"digest":{"line_hashes":["55439535173121503976817818931592893497","127204818329041298298294467612191537359","50310224725132401245228365000792676619","241198617938439281436044265979510326836"],"threshold":0.9},"id":"CVE-2026-34183-a752837c","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517","target":{"file":"ssl/quic/quic_cfq.c"}},{"digest":{"function_hash":"336641234594347542091119058144224198347","length":720},"id":"CVE-2026-34183-a8cc183a","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517","target":{"file":"ssl/quic/quic_rx_depack.c","function":"ossl_quic_handle_frames"},"deprecated":false},{"id":"CVE-2026-34183-b2ab8e7a","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac","target":{"file":"ssl/quic/quic_rx_depack.c"},"deprecated":false,"digest":{"line_hashes":["283211022524522070391448529309217208824","329079506695569061400663688822238529967","259585890385794781954088007576436746201","314126815961107843827539235456990714633","62503776144225813099440801195654852596","320598439248368844790371113406317939478","58198862162490549857774812126231871241","147707582621090092409827604980361027296","181430360261039677944240503697263193139","25679097971967302006810284642134833818","261014217436443070426393070663901061789","195350981400703086860897495539177329907","239703671843759910794410441780722913831","146320624360984835252900854513445348183","136890386920330424456818274815771677790","116336189822934654260715916643076962548","34705193998360244508034785063793939098","314949441320897366462663801149590383427","230963046778763378520884607216231961775","218992521203189519352461685386097434917","254572535331584422775372248106932763356","327303269026737496137750226738302406613","40892436698869330258788510861527714311","265990435268109383772030749012534267652","116723079562187072391301754829068613808","324820671850974229756945205270737310968","221792403960446482882014186362377672968"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac","target":{"file":"include/internal/quic_fifd.h"},"deprecated":false,"digest":{"line_hashes":["317034173942351296182659702637745233270","288307443070895623675948612950410069886"],"threshold":0.9},"id":"CVE-2026-34183-b48370c0"},{"digest":{"function_hash":"336641234594347542091119058144224198347","length":720},"id":"CVE-2026-34183-b86bfd02","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac","target":{"file":"ssl/quic/quic_rx_depack.c","function":"ossl_quic_handle_frames"},"deprecated":false},{"digest":{"line_hashes":["283211022524522070391448529309217208824","329079506695569061400663688822238529967","259585890385794781954088007576436746201","314126815961107843827539235456990714633","62503776144225813099440801195654852596","320598439248368844790371113406317939478","58198862162490549857774812126231871241","147707582621090092409827604980361027296","181430360261039677944240503697263193139","25679097971967302006810284642134833818","261014217436443070426393070663901061789","195350981400703086860897495539177329907","239703671843759910794410441780722913831","146320624360984835252900854513445348183","136890386920330424456818274815771677790","116336189822934654260715916643076962548","34705193998360244508034785063793939098","314949441320897366462663801149590383427","230963046778763378520884607216231961775","218992521203189519352461685386097434917","254572535331584422775372248106932763356","327303269026737496137750226738302406613","40892436698869330258788510861527714311","307794826365935672971165561225991651499","116723079562187072391301754829068613808","324820671850974229756945205270737310968","221792403960446482882014186362377672968"],"threshold":0.9},"id":"CVE-2026-34183-ba458a51","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac","target":{"file":"ssl/quic/quic_rx_depack.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517","target":{"function":"depack_do_frame_path_challenge","file":"ssl/quic/quic_rx_depack.c"},"deprecated":false,"digest":{"function_hash":"132626122019583303694968741362670635918","length":872},"id":"CVE-2026-34183-bcc87eec","signature_type":"Function"},{"target":{"file":"ssl/quic/quic_rx_depack.c"},"deprecated":false,"digest":{"line_hashes":["283211022524522070391448529309217208824","329079506695569061400663688822238529967","259585890385794781954088007576436746201","314126815961107843827539235456990714633","62503776144225813099440801195654852596","320598439248368844790371113406317939478","58198862162490549857774812126231871241","147707582621090092409827604980361027296","181430360261039677944240503697263193139","25679097971967302006810284642134833818","261014217436443070426393070663901061789","195350981400703086860897495539177329907","239703671843759910794410441780722913831","146320624360984835252900854513445348183","136890386920330424456818274815771677790","116336189822934654260715916643076962548","34705193998360244508034785063793939098","314949441320897366462663801149590383427","230963046778763378520884607216231961775","218992521203189519352461685386097434917","254572535331584422775372248106932763356","327303269026737496137750226738302406613","40892436698869330258788510861527714311","307794826365935672971165561225991651499","116723079562187072391301754829068613808","324820671850974229756945205270737310968","221792403960446482882014186362377672968"],"threshold":0.9},"id":"CVE-2026-34183-bf379820","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"},{"target":{"file":"ssl/quic/quic_txp.c"},"deprecated":false,"digest":{"line_hashes":["45128711054467000430936538387457324988","149330818967290373335056504883011268937","165174572031812930150208362394930086547"],"threshold":0.9},"id":"CVE-2026-34183-c60c9c8a","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac","target":{"file":"include/internal/quic_channel.h"},"deprecated":false,"digest":{"line_hashes":["102744523836727665300377928872497083301","36405000379298267152560283059493923791"],"threshold":0.9},"id":"CVE-2026-34183-cc6323aa"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["55439535173121503976817818931592893497","127204818329041298298294467612191537359","50310224725132401245228365000792676619","241198617938439281436044265979510326836"]},"id":"CVE-2026-34183-dbc45130","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac","target":{"file":"ssl/quic/quic_cfq.c"}},{"target":{"file":"ssl/quic/quic_txp.c","function":"txp_pkt_commit"},"deprecated":false,"digest":{"function_hash":"161994472543430899723538006510755481804","length":3008},"id":"CVE-2026-34183-e098c542","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517"},{"target":{"file":"include/internal/quic_fifd.h"},"deprecated":false,"digest":{"line_hashes":["317034173942351296182659702637745233270","288307443070895623675948612950410069886"],"threshold":0.9},"id":"CVE-2026-34183-e30a704e","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb","target":{"file":"ssl/quic/quic_txp.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["45128711054467000430936538387457324988","149330818967290373335056504883011268937","165174572031812930150208362394930086547"]},"id":"CVE-2026-34183-e5d033ee","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"229142732529091447724772618677560281713","length":578},"id":"CVE-2026-34183-f0cc7b78","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac","target":{"file":"ssl/quic/quic_rx_depack.c","function":"ossl_quic_handle_frames"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517","target":{"file":"ssl/quic/quic_rx_depack.c"},"deprecated":false,"digest":{"line_hashes":["283211022524522070391448529309217208824","329079506695569061400663688822238529967","259585890385794781954088007576436746201","314126815961107843827539235456990714633","62503776144225813099440801195654852596","320598439248368844790371113406317939478","58198862162490549857774812126231871241","147707582621090092409827604980361027296","181430360261039677944240503697263193139","25679097971967302006810284642134833818","261014217436443070426393070663901061789","195350981400703086860897495539177329907","239703671843759910794410441780722913831","146320624360984835252900854513445348183","136890386920330424456818274815771677790","116336189822934654260715916643076962548","34705193998360244508034785063793939098","314949441320897366462663801149590383427","230963046778763378520884607216231961775","218992521203189519352461685386097434917","254572535331584422775372248106932763356","327303269026737496137750226738302406613","40892436698869330258788510861527714311","307794826365935672971165561225991651499","116723079562187072391301754829068613808","324820671850974229756945205270737310968","221792403960446482882014186362377672968"],"threshold":0.9},"id":"CVE-2026-34183-f8b24c3d"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac","target":{"file":"ssl/quic/quic_channel.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["125836126259094406777805326932883223191","60821833181468548777893932459539788475","296667982168421279828153649100201152846"]},"id":"CVE-2026-34183-fb8378cb","signature_type":"Line"},{"digest":{"line_hashes":["246818849505342602955063588459453274592","142039821623459103211929688998001696677","249537960300591757396437299874197582936","201112550313325936933021758451806127378","312972453870536606714670309149540804956","276790711039654102130544296735538223365","152010330387736881777572324036182495290","211360042034583066576407184200396274745","292917114161060296173144304212059980858","60503260939705954420693585677802080872","298018461312991046913517634245101399641"],"threshold":0.9},"id":"CVE-2026-34183-fba742e1","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac","target":{"file":"ssl/quic/quic_channel_local.h"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb","target":{"file":"ssl/quic/quic_txp.c","function":"txp_pkt_commit"},"deprecated":false,"digest":{"function_hash":"161994472543430899723538006510755481804","length":3008},"id":"CVE-2026-34183-fe66950c","signature_type":"Function"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}