CVE-2026-18798

Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.

• CWE-415

• https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13afPatch
• https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3cPatch
• https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4Patch
• https://openssl-library.org/news/secadv/20260825.txtVendor Advisory

Published

Aug 25, 2026

Last Modified

Sep 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18788A security flaw has been discovered in Trippo ResponsiveFile…7.3
• CVE-2026-18789The Ezoic WordPress plugin before 2.23.1 does not properly r…7.5
• CVE-2026-1879A vulnerability was detected in Harvard University IQSS Data…6.3
• CVE-2026-18790A weakness has been identified in Systerel S2OPC up to 1.7.3…3.3
• CVE-2026-18794The OpenRGB network protocol allows attackers to cause memor…8.2
• CVE-2026-18796Any application that uses external QSPI flash for encry…6.8
• CVE-2026-1880An Incorrect Permission Assignment for Critical Resource vul…5.4
• CVE-2026-18801OpenMeter contains a stored, or second-order, SQL injection …9.3
• CVE-2026-18806External control of file name or path vulnerability in TÜBİT…7.1
• CVE-2026-18807The ECS WordPress plugin before 4.3.8 does not have capabil…4.3
• CVE-2026-18808Improper Control of Generation of Code ('Code Injection') vu…9.8
• CVE-2026-18809Information disclosure in Firefox for Android and Firefox Fo…6.5