# CVE-2026-54873: QUIC STREAM Fragment Metadata DoS

> Remote attackers can cause memory exhaustion in OpenSSL's QUIC implementation by sending crafted packets, leading to denial of service.

- **Severity:** High 7.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 29 Sep 2026
- **Updated:** 30 Sep 2026
- **Also known as:** AZL-105435, AZL-105495, AZL-105576, AZL-105606, AZL-105846, AZL-105867, BELL-CVE-2026-54873, CLEANSTART-2026-OZ62377, DEBIAN-CVE-2026-54873, GHSA-8jj8-6qjx-8659, MINI-575v-j77h-6m8v, UBUNTU-CVE-2026-54873

## What is CVE-2026-54873?

CVE-2026-54873 is a high-severity denial of service vulnerability in Openssl Openssl, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

Issue summary: QUIC process may keep memory for QUIC packet
buffer for much longer period than necessary.

Impact summary: Remote peer can exploit this vulnerability
by sending maliciously crafted packets, making the local
QUIC stack to keep the memory for packet buffers allocated.
The time for which the memory remains allocated is entirely
under the control of the potentially malicious remote peer.

CWE: CWE-770: Allocation of Resources Without Limits or Throttling

Description: To save copy operation from the packet buffer to the
stream reassemble buffer the QUIC stack leaves the stream data
on the packet buffer waiting to be copied to a buffer provided
by the local receiving application. The QUIC stack releases
a reference to the packet buffer only after the data are copied
to the application buffer. This design is more efficient for
legitimate data transfers but enables an attacker to allocate a lot
more memory than actually required by the data kept in the receiving
stream buffer.

To mitigate the vulnerability, the QUIC stack now calculates
and monitors memory overhead for every stream. The memory overhead
for a single stream frame is calculated as a difference between the
size of the whole packet that carries the stream frame and the size
of the stream frame itself. The memory overhead for a single stream
frame is added to the total (cumulative) memory overhead QUIC stack
keeps for each stream. Once the cumulative memory overhead exceeds
64kB, the QUIC stack moves the stream frame data from the packet
buffer to the stream buffer, starting with the next packet received.

FIPS impact: no
The FIPS module is not affected as the QUIC implementation is outside of
the OpenSSL FIPS module boundary.

Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling)

## Which versions are affected by CVE-2026-54873?

It affects 1 product.


Products: Openssl Openssl.

## How do I fix CVE-2026-54873?

Apply the vendor's patch.

## Is CVE-2026-54873 being exploited?

There is no known exploitation of CVE-2026-54873 in the wild and no public exploit code.

## Other vulnerabilities in Openssl Openssl

- [CVE-2009-3245](https://insights.sbomify.com/CVE-2009-3245/): Null dereference in n/a (critical 10.0)
- [CVE-2006-3738](https://insights.sbomify.com/CVE-2006-3738/): Memory corruption in n/a (critical 10.0)
- [CVE-2026-63073](https://insights.sbomify.com/CVE-2026-63073/): Untrusted Sender DN Used as Format String in CMP Response Validation (critical 9.8)
- [CVE-2016-6309](https://insights.sbomify.com/CVE-2016-6309/): Use after free in n/a (critical 9.8)
- [CVE-2016-0799](https://insights.sbomify.com/CVE-2016-0799/): Integer overflow in n/a (critical 9.8)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-54873 and fix it if it is affected.

What it is: CVE-2026-54873 is a high-severity denial of service vulnerability in Openssl Openssl, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-54873 in the wild and no public exploit code.

Affected product: Openssl Openssl. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-54873/ (Markdown: https://insights.sbomify.com/CVE-2026-54873/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-54873
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-54873
- OSV: https://osv.dev/vulnerability/CVE-2026-54873

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-54873/
Summaries are generated and may contain mistakes; the official description above is the record.