Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes
\nvalid QUIC Initial packets for unknown destination connection IDs, it
\ncan allocate and queue new incoming channels without enforcing any limit.<\/p>\n
Impact summary: A remote peer that can make many Initial packets reach the
\nserver listener faster than the application accepts connections, can cause the
\nmemory allocated to store the per-channel state to grow without any limits,
\npotentially making the QUIC listener unavailable and causing Denial of Service.<\/p>\n
CWE: CWE-770: Allocation of Resources Without Limits or Throttling<\/p>\n
Description: The function that handles inbound QUIC packets uses
\nConnection-Id from the packet header to find an existing connection
\n(QUIC channel). If no existing connection is found and the packet
\ntype is INITIAL, the function treats the packet as a new connection. It
\nallocates a new channel object and inserts it into a queue where it
\nwaits to be accepted by the local application with SSL_accept(3ossl).
\nThe memory occupied by these initial channel objects may grow
\nwithout bounds if the application is not able to call SSL_accept()
\nfrequently enough to serve these inbound connection requests.<\/p>\n
The issue is present since OpenSSL 3.5 when the QUIC server implementation
\nwas added.<\/p>\n
The fix introduces a limit for pending connections. The default limit is set
\nto 256 pending connections (waiting to be accepted by the local application).
\nApplications may change the default by calling SSL_set_value_uint(3ossl).<\/p>\n
FIPS impact: no
\nThe FIPS module is not affected as the QUIC implementation is outside of
\nthe OpenSSL FIPS module boundary.<\/p>\n","protected":false},"excerpt":{"rendered":"
Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes
\nvalid QUIC Initial packets for unknown destination connection IDs, it
\ncan allocate and queue new incoming channels without en<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6419","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6419","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6419"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6419"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6419"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}