{"id":30627,"date":"2026-09-30T00:31:20","date_gmt":"2026-09-29T16:31:20","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-75804"},"modified":"2026-09-30T00:31:20","modified_gmt":"2026-09-29T16:31:20","slug":"cve-2026-75804","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-75804","title":{"rendered":"CVE-2026-75804 &#8211; Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for strea"},"content":{"rendered":"<p>Issue summary: OpenSSL QUIC stack does not enforce connection<br \/>\nlevel flow control for streams. Remote peers may send more bytes<br \/>\nas long as they fit within the stream flow control limits.<\/p>\n<p>Impact summary: A malicious remote peer may exploit the lack of connection<br \/>\nflow control for streams to make the QUIC stack receive ~100MB of memory<br \/>\ninstead of 768 KiB (default flow control window size).<\/p>\n<p>CWE: CWE-770: Allocation of Resources Without Limits or Throttling<\/p>\n<p>Description: The local QUIC stack advertises two flow control limits<br \/>\nto its remote peer: stream flow control limit and connection flow<br \/>\ncontrol limit. The remote peer must follow both limits when transmitting<br \/>\nstream data.<\/p>\n<p>Whenever the local QUIC stack receives a stream frame, it validates<br \/>\nthat the size of the received stream frame stays within flow control limits.<br \/>\nIf either limit is exceeded (stream level or connection level), then<br \/>\nthe QUIC stack must close the connection with a flow control error.<\/p>\n<p>The vulnerable OpenSSL QUIC stack enforces the stream-level but not<br \/>\nthe connection-level limit. To exploit the issue, three conditions must be met:<br \/>\n  &#8211; the remote peer opens several streams<br \/>\n  &#8211; each stream must stay within the stream-level flow control limit<br \/>\n  &#8211; there must be no zero-offset byte sent on any of the streams<br \/>\n    (to prevent the vulnerable QUIC stack from consuming data).<br \/>\nBy meeting the conditions above, the remote peer may make the local stack<br \/>\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes<br \/>\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both<br \/>\nbidirectional and unidirectional streams, making it 200 in total. The default<br \/>\nflow control window for a stream is 512kB. The remote peer may<br \/>\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.<\/p>\n<p>FIPS impact: no<br \/>\nThe FIPS module is not affected as the QUIC implementation is outside of<br \/>\nthe OpenSSL FIPS module boundary.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Issue summary: OpenSSL QUIC stack does not enforce connection<br \/>\nlevel flow control for streams. Remote peers may send more bytes<br \/>\nas long as they fit within the stream flow control limits.<\/p>\n<p>Impact summar<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-30627","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/30627","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30627"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30627"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30627"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}