GCVE-110-NCSC-2026-373

Advisory PublishedCVSS 8.1/10

Vulnetix · Advisory published September 16, 2026

OpenSSL QUIC server versions 3.5, 3.6, and 4.0 have a vulnerability allowing remote attackers to cause unbounded memory allocation and Denial of Service by sending numerous Initial packets, with Oracle Autonomous Health Framework also affected.

Download JSON Open in Console

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or ThrottlingCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Risk Scores

CVSS 3.1

8.1/10

High · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
Oracle Corporation	vers:unknown/*	—	—
Oracle	vers:unknown/*	—	—

Aliases

CVE-2026-14456 CVE-2026-75838 CVE-2026-83088 CVE-2026-83148 CVE-2026-83149 CVE-2026-83150 CVE-2026-83156 CVE-2026-83160 CVE-2026-83271 CVE-2026-83272 CVE-2026-83333 CVE-2026-83347 CVE-2026-83348 CVE-2026-83349 CVE-2026-83350 CVE-2026-83351

References

advisory

Browse GCVE Records

406 records in the GCVE database · Updated September 17, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON