CVE-2026-34183 Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

High 7.5 Published 9 Jun 2026 Updated 10 Jun 2026

A remote attacker can cause a Denial of Service in OpenSSL QUIC implementations by flooding PATH_CHALLENGE frames, leading to unbounded memory growth and application termination.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-34183?

CVE-2026-34183 is a high-severity denial of service vulnerability in Openssl Openssl, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Weakness: CWE-1325

Which versions are affected by CVE-2026-34183?

It affects 1 product.

Products include Openssl Openssl.

How do I fix CVE-2026-34183?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-34183 being exploited?

There is no known exploitation of CVE-2026-34183 in the wild and no public exploit code.

All Openssl Openssl vulnerabilities

Sources

Also known as ALPINE-CVE-2026-34183, AZL-89925, BELL-CVE-2026-34183, DEBIAN-CVE-2026-34183, GHSA-f5vx-f6jp-89j6, JLSEC-2026-1136 and 2 more.