CVE-2026-14456

OpenSSL 3.5's QUIC implementation contains a design flaw at its core: the Listener allocates network-layer resources the moment a packet arrives, but the application controls when those resources are released through SSL_accept(). This creates a race condition that an attacker can exploit to exhaust server memory by flooding Initial packets with unknown connection IDs faster than the application can drain them. The patch imposes a 256-pending-connection ceiling. This stops the crash but leaves two serious gaps. First, the 256 figure has no documented derivation—it reads as a conservative round number chosen under release pressure rather than a threshold tuned for production QUIC workloads. If you're running a CDN or high-throughput API gateway, you may hit this ceiling during legitimate traffic spikes and generate false positives in your monitoring. Second, and more critically, the behavior when the limit is hit is not specified in the advisory. If the server silently drops packets above the threshold, an attacker who knows the limit can maintain exactly 256 pending connections with minimal traffic and permanently block new legitimate handshakes. That's a trivially executable DoS with near-perfect reliability—worse than the original vulnerability, which at least required flooding faster than the application could accept. This is not a one-off bug. The architectural mismatch between packet-handling and application callbacks runs through OpenSSL's history (CWE-770 allocations without bounds appear repeatedly). The QUIC layer inherited assumptions from TLS-era synchronous connection models that don't apply to QUIC's decoupled design. Expect similar resource-management gaps in handshake state machines and stream credit logic. Monitor your QUIC listeners for connection counts hovering near 256—this pattern indicates either an active attack or a misconfigured deployment. If you raise the limit to accommodate legitimate load, you recreate the unbounded condition the CVE patches. The 7.5 CVSS score understates the risk: this is an unauthenticated, trivially executable network attack with no special positioning required.

Reviewed through automated stages and approved by a human before publication.