CVE-2026-42764

What it actually does

This vulnerability affects OpenSSL-based QUIC server implementations that explicitly disable client address validation by using SSL_LISTENER_FLAG_NO_VALIDATE with SSL_new_listener(). In that non-default configuration, a remote unauthenticated attacker can send a QUIC Initial packet containing an invalid or expired token and trigger a NULL pointer dereference in the QUIC server code path. The typical result is abnormal termination of the affected server process, causing denial of service. Confidentiality and integrity are not directly impacted, and OpenSSL FIPS modules are not affected because the vulnerable code is outside the FIPS module boundary.

Why it matters to the business

An exposed QUIC service using the vulnerable non-default OpenSSL configuration can be remotely crashed without authentication, potentially interrupting customer-facing applications, APIs, edge services, or other UDP/QUIC-enabled workloads until the service restarts or traffic is mitigated. The risk is moderated by the fact that OpenSSL enables address validation by default, EPSS is low and stable, there is no known CISA KEV listing, and no mature public exploit is reported in the supplied data; however, internet-exposed QUIC services remain attractive denial-of-service targets because exploitation requires only network reachability.

How an attack unfolds

An attacker first identifies a service that accepts QUIC traffic and is implemented with the affected OpenSSL QUIC server functionality. The attacker then determines or assumes that the server has disabled client address validation using the non-default SSL_LISTENER_FLAG_NO_VALIDATE option. The attacker sends a crafted QUIC Initial packet containing an invalid or expired token. Because address validation is disabled, the vulnerable processing path is reachable and mishandles the invalid token, resulting in a NULL pointer dereference. The server process then crashes, producing a denial of service until it is automatically restarted, manually recovered, or shielded from the malicious traffic. Repeated packets can be used to cause recurring outages if the vulnerable service remains exposed.

How to fix it

Upgrade OpenSSL and affected products that embed or link against OpenSSL to a vendor-provided version that contains the fix once available for the deployed branch. Because no exact fixed versions were supplied, track the OpenSSL security advisory and operating system, appliance, container image, and application vendor advisories for patched packages. As an immediate mitigation, ensure OpenSSL QUIC servers do not disable client address validation: avoid using SSL_LISTENER_FLAG_NO_VALIDATE with SSL_new_listener() unless there is a compensating control. Restrict exposure of QUIC listener ports to trusted networks where possible, apply UDP/QUIC rate limiting at edge devices, and use load balancers or reverse proxies capable of filtering malformed or abusive QUIC Initial traffic. Ensure affected services are supervised by process managers for automatic restart, but do not rely on restart alone as a security fix.

How to confirm the fix worked

Confirm whether any deployed service uses OpenSSL QUIC server functionality and accepts QUIC traffic from untrusted networks. Review source code, build configuration, and runtime configuration for use of SSL_new_listener() combined with SSL_LISTENER_FLAG_NO_VALIDATE; if that flag is not used, the default OpenSSL behavior should not be vulnerable according to the advisory. Inventory linked OpenSSL versions in binaries, containers, packages, and appliances, then verify they match vendor-fixed releases when available. Validate that QUIC address validation remains enabled after configuration changes. In a controlled non-production environment only, resilience can be tested by sending invalid-token QUIC Initial traffic and confirming the service does not crash. Also verify that monitoring detects abnormal QUIC process exits, core dumps, and repeated restarts.

Typical attack path

1. Scan for internet-accessible UDP/QUIC services, commonly on UDP/443 or other application-specific QUIC ports.
2. Select targets that appear to use an OpenSSL-based QUIC server implementation.
3. Send QUIC Initial packets containing invalid, malformed, or expired tokens.
4. Trigger the vulnerable non-default code path when client address validation is disabled.
5. Cause the affected server process to crash due to a NULL pointer dereference.
6. Repeat the traffic to keep the service unstable or unavailable after restarts.

How to detect it

Look for evidence of abnormal termination of QUIC-enabled services linked to OpenSSL, especially crashes occurring immediately after bursts of UDP/QUIC Initial traffic from one or more external sources. Useful log sources include application logs, reverse proxy or load balancer logs, systemd/journald logs, syslog, kernel logs, container runtime logs, Kubernetes events, process supervisor logs, EDR process telemetry, core dump metadata, and network flow or packet telemetry for UDP/443 and other QUIC listener ports. Search for segmentation faults, NULL pointer dereference messages, coredumps, repeated service restarts, and QUIC token validation errors. Correlate crash timestamps with network telemetry showing QUIC Initial packets containing invalid, malformed, or expired tokens. If core files are available, inspect stack traces for OpenSSL QUIC listener/token-processing frames. No specific named threat actors or ransomware use are provided, and exploit maturity is listed as none, so detection should focus on behavioral signs of attempted denial of service rather than actor-specific infrastructure.

• SSL_LISTENER_FLAG_NO_VALIDATE
• SSL_new_listener
• invalid token
• expired token
• QUIC Initial
• QUIC initial packet
• NULL pointer dereference
• Segmentation fault
• segfault
• core dumped
• coredump
• systemd-coredump
• Process terminated by signal 11
• SIGSEGV
• udp/443

What your security team should do

• Prioritize inventory of internet-facing QUIC/UDP services that use OpenSSL, especially services exposed on UDP/443.
• Review application code and configuration for SSL_LISTENER_FLAG_NO_VALIDATE; remove this flag unless there is a documented, risk-accepted requirement.
• Track OpenSSL and downstream vendor advisories for fixed package versions and patch affected deployments promptly when updates are available.
• Apply edge rate limiting and filtering for suspicious QUIC Initial floods or repeated invalid-token attempts against exposed services.
• Enable or verify service supervision, crash alerting, and core dump collection for QUIC-enabled server processes.
• Add detections for QUIC service crashes, segmentation faults, and repeated restarts correlated with bursts of QUIC Initial packets.
• Because this is not currently listed in KEV and EPSS is low and stable, prioritize based on exposure and business criticality rather than treating all OpenSSL deployments as equally urgent.