VDB
RHSA-2026:56097
RHSA-2026:56097
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption can result in a Denial of Service (DoS) condition, making the QUIC listener unavailable.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openssl-main@x86_64 as a component of Red Hat Hardened Images | * |
| Red Hat | openssl-1:3.5.6-0.5.hum1@src as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-devel-engine-1:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-fips-provider-upstream-1:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-devel-1:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-config-fips-1:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-fips-provider-upstream-1:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-0:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-libs-1:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-libs-1:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-1:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-0:3.5.6-0.5.hum1@src as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-main@aarch64 as a component of Red Hat Hardened Images | * |
| Red Hat | openssl-main@src as a component of Red Hat Hardened Images | * |
| Red Hat | openssl-0:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-perl-1:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-perl-1:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-1:3.5.6-0.5.hum1@x86_64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-config-fips-1:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
| Red Hat | openssl-devel-1:3.5.6-0.5.hum1@aarch64 as a component of Red Hat Hardened Images | 3.5.6-0.5.hum1 |
…and 1 more
Timeline
- Aug 18, 2026 CVE Published
- Oct 22, 2026 CVE Updated
- Oct 22, 2026 Distribution Patch
- Oct 22, 2026 Distribution Patch
- Oct 22, 2026 Security Advisory
- Oct 22, 2026 Security Advisory
- Oct 22, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:56097 advisory
- https://access.redhat.com/security/cve/CVE-2026-14456 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://images.redhat.com/ advisory
- https://access.redhat.com/security/cve/CVE-2026-54876 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56097.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2515348 issue
- https://www.cve.org/CVERecord?id=CVE-2026-14456 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-14456 advisory
- https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9 advisory
- https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b advisory
- https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139 advisory
- https://openssl-library.org/news/secadv/20260813.txt advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2511600 issue
- https://www.cve.org/CVERecord?id=CVE-2026-54876 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-54876 advisory
- https://github.com/openssl/openssl/commit/155b5fe0f93365e6df1c56ee3606b121080c6c12 advisory
- https://github.com/openssl/openssl/commit/d8c51048ac037a21bae0f41cad7a3920dc7f3638 advisory
- https://openssl-library.org/news/secadv/20260805.txt advisory