CVE-2026-18798

Technical Description

Issue summary: QUIC server may double free QRX (QUIC record layer RX) object

when channel creation fails for initial packet.

Impact summary: Double free leads to heap corruption, which typically results in

termination of QUIC server process, leading to Denial of Service. There is so

far no evidence that this double free is exploitable for remote code execution,

thus it is considered highly improbable.

CWE: CWE-415: Double Free

Description: In order to validate initial packet, OpenSSL QUIC stack default

packet handler (port_default_packet_handler()) creates a so-called QRX object.

If the initial packet validates successfully with QRX object, the default packet

handler proceeds to channel (connection object) creation. The QRX object used

for packet validation is passed to port_bind_channel(), so it becomes part of

the newly created connection. If port_bind_channel() fails, then it also frees

the QRX object. Once port_bind_channel() returns, the port_default_packet_handler()

detects t

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References