{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-14456 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-14456 is a high-severity denial of service vulnerability in OpenSSL, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-14456 and fix it if it is affected.\n\nWhat it is: CVE-2026-14456 is a high-severity denial of service vulnerability in OpenSSL, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-14456 in the wild and no public exploit code.\n\nAffected product: OpenSSL. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-14456/ (Markdown: https://insights.sbomify.com/CVE-2026-14456/index.md)","id":"CVE-2026-14456","markdown":"https://insights.sbomify.com/CVE-2026-14456/index.md","name":"CVE-2026-14456","record":{"aliases":["ALPINE-CVE-2026-14456","BELL-CVE-2026-14456","CLEANSTART-2026-IL62740","DEBIAN-CVE-2026-14456","ECHO-67da-49b3-07ec","GHSA-9x89-v382-mjh7","MINI-rm7g-mgvf-vhwq","OESA-2026-3579","ROOT-OS-DEBIAN-11-CVE-2026-14456","UBUNTU-CVE-2026-14456"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"OpenSSL QUIC server","requires_auth":"none","summary":"Remote attackers can cause denial of service in OpenSSL QUIC servers by exhausting memory through unbounded channel queue growth.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"openssl","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"}],"description":"Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Unbounded Memory Growth in QUIC Server Incoming Channel Queue","id":"CVE-2026-14456","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate","id":"CVE-2026-14457"},"packages":[],"prev":{"headline":"Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed","id":"CVE-2026-14454"},"products":["OpenSSL"],"published":"2026-08-13","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-13","vendors":["OpenSSL"]},"summary":"Remote attackers can cause denial of service in OpenSSL QUIC servers by exhausting memory through unbounded channel queue growth.","url":"https://insights.sbomify.com/CVE-2026-14456/"}