openssl: QUIC server may trigger double free when processing INITIAL packet

A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID destination connection ID can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service...

CVE-2026-18798

A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID destination connection ID can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service. Mitigatio...

CVE-2026-18798

The OpenSSL QUIC stack's default packet handler (port_default_packet_handler() ) is vulnerable to a double free of a QRX object . When an INITIAL packet validates but fails during channel creation via port_bind_channel() , the object is freed by the function and then freed again by the handler's ...

EUVD-2006-2553

Malware in sbrugna...

CVE-2024-25678

In LiteSpeed QUIC LSQUIC Library before 4.0.4, DCID validation is mishandled...

CVE-2024-25678

In LiteSpeed QUIC LSQUIC Library before 4.0.4, DCID validation is mishandled...

Design/Logic Flaw

In LiteSpeed QUIC LSQUIC Library before 4.0.4, DCID validation is mishandled...

CVE-2024-25678

In LiteSpeed QUIC LSQUIC Library before 4.0.4, DCID validation is mishandled...

CVE-2024-25678

In LiteSpeed QUIC LSQUIC Library before 4.0.4, DCID validation is mishandled...

CVE-2024-25678

Summary: CVE-2024-25678 affects the LiteSpeed QUIC (LSQUIC) Library prior to 4.0.4, due to mishandled DCID validation. The issue is tied to the authentication/DCID handling behavior in LSQUIC. Affected software: LiteSpeed QUIC (LSQUIC) Library versions before 4.0.4. Root cause (as stated): Mishan...

PT-2024-21086 · Litespeed · Lsquic

Name of the Vulnerable Software and Affected Versions: LiteSpeed QUIC LSQUIC Library versions prior to 4.0.4 Description: The issue is related to mishandled DCID validation. Recommendations: For versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue...

CVE-2024-25678: Improper Validation of Integrity Check Value

In LiteSpeed QUIC LSQUIC Library before 4.0.4, DCID validation is mishandled...

CVE-2024-25678

In LiteSpeed QUIC LSQUIC Library before 4.0.4, DCID validation is mishandled...

Cross site scripting

Cross-site scripting XSS vulnerability in Jemscripts DownloadControl 1.0 allows remote attackers to inject arbitrary HTML or web script via the dcid parameter to dc.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. This issue...

CVE-2006-2553

This entry documents an XSS vulnerability in Jemscripts DownloadControl 1.0, exploitable via the dcid parameter to dc.php. Conditions: remote attacker can inject arbitrary HTML or web script. The cited CVSS shows MEDIUM severity (AV:N/AC:M/Au:N/C:P/I:N/A:N) with partial confidentiality impact; no...

CVE-2006-2552: Undefined Security Weakness

Jemscripts DownloadControl 1.0 allows remote attackers to obtain sensitive information via an invalid dcid parameter to dc.php, which leaks the pathname in an error message. NOTE: this was originally claimed to be SQL injection, but it is probably resultant from another issue in functions.php...

CVE-2006-2553: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Jemscripts DownloadControl 1.0 allows remote attackers to inject arbitrary HTML or web script via the dcid parameter to dc.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. This issue...