CVE-2026-84784

What it actually does

The OpenSSL QUIC stack does not enforce RFC 9000 limits on how many destination connection IDs a remote peer may issue. A peer can send unbounded NEW_CONNECTION_ID frames; the local stack retires destination CIDs immediately and enqueues a RETIRE_CONNECTION_ID frame on the Control Frame Queue for each one. If the peer withholds ACKs, the CFQ grows without bound and can allocate on the order of ~400MB per connection (depending on ACK delay), exhausting process or host memory. Confidentiality and integrity are unaffected; this is remote, unauthenticated resource exhaustion (CWE-770). The FIPS module is not affected because QUIC is outside the FIPS boundary.

Why it matters to the business

Internet-facing services that terminate QUIC with affected OpenSSL (HTTP/3 and other QUIC endpoints on Red Hat openssl-main and openssl3-main) can be made unresponsive or OOM-killed by an unauthenticated remote peer, causing outages, SLA impact, and excess memory cost. The issue was published five days ago, is not in CISA KEV, is not associated with ransomware, and has no known public exploit, but CVSS 7.5 with network reachability still warrants prompt patching of exposed QUIC listeners.

How an attack unfolds

An unauthenticated attacker completes a QUIC handshake to a vulnerable OpenSSL-based endpoint, then sends a flood of NEW_CONNECTION_ID frames while withholding acknowledgements. The stack processes more retirements than RFC 9000 allows, queues a RETIRE_CONNECTION_ID for each frame, and cannot drain the Control Frame Queue without ACKs, driving memory toward hundreds of megabytes per connection. Additional parallel connections amplify exhaustion until the process stalls or is killed. No privileges or user interaction are required. No named threat actors or campaigns are associated with this CVE, and exploit maturity is none.

How to fix it

Upgrade Red Hat openssl-main and openssl3-main to 3.5.9-0.1.hum1 or later (RHSA-2026:74162) and restart processes that load the OpenSSL QUIC stack. The fix retires destination CIDs only after the RETIRE_CONNECTION_ID frame is acknowledged, which bounds Control Frame Queue growth. If you cannot patch immediately, disable or do not expose QUIC/HTTP/3 listeners, terminate QUIC at a patched front end, and restrict untrusted UDP QUIC traffic. No FIPS module update is required.

How to confirm the fix worked

Confirm installed packages are 3.5.9-0.1.hum1 or newer and that QUIC-enabled applications were restarted against the patched library. Inventory HTTP/3 and other QUIC listeners and verify they are patched or disabled. After upgrade, QUIC process memory should remain stable under connection-ID churn rather than growing without bound. Use configuration and package inventory plus controlled staging checks; do not attempt unauthenticated resource-exhaustion tests against production.

Typical attack path

1. Locate an internet-reachable service using a vulnerable OpenSSL QUIC stack (for example HTTP/3).
2. Complete a QUIC handshake as an unauthenticated remote peer.
3. Send a high volume of NEW_CONNECTION_ID frames while withholding ACKs so RETIRE_CONNECTION_ID frames accumulate on the Control Frame Queue.
4. Drive per-connection memory toward hundreds of megabytes until the process is starved, OOM-killed, or unresponsive.
5. Open additional QUIC connections as needed to amplify resource exhaustion.

How to detect it

There are no reliable on-disk malware artifacts. Hunt for prior exploitation via host memory and OOM telemetry plus QUIC/UDP traffic: sudden RSS growth or OOM kills of processes linked to OpenSSL QUIC with little corresponding application load; kernel or systemd OOM messages for those processes; UDP flows (commonly port 443) showing a high rate of QUIC NEW_CONNECTION_ID activity with delayed or missing ACKs from one or few sources; and connection tables with few sessions but outsized memory. Correlate with pre-patch package versions (openssl-main or openssl3-main older than 3.5.9-0.1.hum1). No named threat actors are tied to this CVE, so actor-specific hunting is not applicable.

• NEW_CONNECTION_ID
• RETIRE_CONNECTION_ID
• RETIRE_CONN_ID
• quic
• UDP/443
• Out of memory: Kill process
• oom-kill
• openssl
• libssl
• HTTP/3
• h3

What your security team should do

• Patch openssl-main and openssl3-main to 3.5.9-0.1.hum1 (RHSA-2026:74162) on all hosts that load OpenSSL QUIC, then restart affected services.
• Inventory and prioritize internet-facing QUIC/HTTP/3 listeners; disable QUIC or move termination to a patched front end until those hosts are upgraded.
• Watch QUIC-handling processes for abnormal RSS growth, OOM kills, and UDP/443 (or other QUIC ports) floods from single sources.
• Treat this as a high-availability patch for exposed QUIC even though it is not KEV and no public exploit is known; track RHSA-2026:74162 to completion.
• No FIPS recertification or module change is needed for this issue.