CVE-2026-18798 QUIC Server May Trigger Double Free When Processing INITIAL Packet
A double free vulnerability in the OpenSSL QUIC server allows remote attackers to cause a denial of service via malformed INITIAL packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-18798?
CVE-2026-18798 is a high-severity memory corruption vulnerability in Openssl Openssl, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet.
Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable.
CWE: CWE-415: Double Free
Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time.
The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length.
FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.
Weakness: CWE-415
Which versions are affected by CVE-2026-18798?
It affects 1 product.
Products include Openssl Openssl.
How do I fix CVE-2026-18798?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-18798 being exploited?
There is no known exploitation of CVE-2026-18798 in the wild and no public exploit code.
Other vulnerabilities in Openssl Openssl
Sources
Also known as ALPINE-CVE-2026-18798, BELL-CVE-2026-18798, CLEANSTART-2026-QD52056, DEBIAN-CVE-2026-18798, GHSA-3j55-qf57-hqc2, MINI-mc66-p6g2-353j and 1 more.