--- id: CVE-2026-18798 title: >- Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server pr… summary: >- Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server pr… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-415 vendor: openssl product: openssl affected: - 'openssl >= 3.5.0, < 3.5.8' - 'openssl >= 3.6.0, < 3.6.4' - 'openssl >= 4.0.0, < 4.0.2' patched: - openssl 4.0.2 published: '2026-08-25' updated: '2026-09-23' sourceUpdated: '2026-09-23T16:07:09.323' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18798' references: - url: >- https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c label: openssl-security@openssl.org - url: >- https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4 label: openssl-security@openssl.org - url: 'https://openssl-library.org/news/secadv/20260825.txt' label: openssl-security@openssl.org - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18798.json - url: 'https://access.redhat.com/security/cve/CVE-2026-18798' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2517559' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-18798' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18798' - url: 'https://access.redhat.com/errata/RHSA-2026:67154' - url: 'https://access.redhat.com/errata/RHSA-2026:67165' - url: 'https://access.redhat.com/errata/RHSA-2026:59641' - url: 'https://access.redhat.com/errata/RHSA-2026:59635' - url: 'https://access.redhat.com/errata/RHSA-2026:67956' - url: 'https://access.redhat.com/errata/RHSA-2026:71603' tags: - nvd - csaf - vex - red-hat epss: 0.01537 epssPercentile: 0.73798 ingestedAt: '2026-09-23T16:27:22.632Z' --- ## Overview Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary. ## Affected - `openssl >= 3.5.0, < 3.5.8` - `openssl >= 3.6.0, < 3.6.4` - `openssl >= 4.0.0, < 4.0.2` ## Remediation Upgrade past the affected range: - `openssl 4.0.2` ## Vendor advisories - **RHSA-2026:67154** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67154) - **RHSA-2026:67165** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67165) - **RHSA-2026:59641** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59641) - **RHSA-2026:59635** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59635) - **RHSA-2026:67956** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67956) - **RHSA-2026:71603** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71603) - **Red Hat VEX** · Moderate · affected: Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat JBoss Core Services, Red Hat JBoss Web Server 6, Red Hat JBoss Web Server 7, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat JBoss Core Services, Red Hat JBoss Web Server 6, Red Hat JBoss Web Server 7, Red Hat Developer Hub, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18798.json)