CVE-2026-63075

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

CVE-2026-63075

OpenSSL's QUIC stack retains ACK-only packet metadata in its packet history for the full lifetime of a connection. Since ACK-only packets are not ack-eliciting, a remote peer that completes a QUIC handshake can force repeated ACK-only packet transmission (e.g., by sending numerous PING frames ) a...

EUVD-2026-65485

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...