CVE-2026-35191

The OpenSSL QUIC server is vulnerable to a violation of the RFC 9000 unvalidated connection amplification limit when address validation is disabled. The root cause is that the QUIC stack incorrectly adds the length of an entire datagram to the unvalidated credit limit for every individual QUIC pa...