openssl

Добро пожаловать в проект OpenSSL OpenSSL — это надёжный, промышленного уровня, полнофункциональный набор инструментов с открытым исходным кодом для протоколов Transport Layer Security TLS, ранее SSL, Datagram TLS DTLS и QUIC. Реализации протоколов основаны на мощной криптографической библиотеке...

ssh3

!NOTE SSH3, вероятно, сменит название. Он по-прежнему использует протокол SSH Connection Protocol RFC4254, работающий поверх HTTP/3 Extended connect, но требуемые изменения слишком масштабны и слишком далеки от философии популярных реализаций SSH, чтобы рассматривать их для интеграции. Черновик...

CVE-2025-54939

PoC для QUIC-LEAK CVE-2025-54939 в LSQUIC Обзор Этот PoC демонстрирует CVE-2025-54939, уязвимость истощения памяти отказ в обслуживании до установления соединения в реализации QUIC от LSQUIC. Проблема, названная QUIC-LEAK, впервые была задокументирована Imperva:...

CVE-2026-6060-QUIC-Handshake-Amplification-via-Address-Validation-Bypass

CVE-2026-6060 – 주소 검증 우회를 통한 QUIC 핸드셰이크 증폭 프로그램 코드 Python 시뮬레이션 root@kitploit: quicserversim.py - Vulnerable QUIC server simulated handshake import socket def sendquicinitialconn, addr, serversalt: Respond with a large "server hello" without validating source address In real QUIC, the server must...

CVE-2026-4253-Scanner

CVE-2026-42530 — Safe-Check Scanner NGINX HTTP/3QUIC use-after-free 취약점을 위한 비파괴적 대량 스캐너 버그를 절대 트리거하지 않고 어떤 호스트가 노출되었는지 파악하세요. ⚠️ 고지 사항 이 도구는 승인된 보안 테스트 전용 입니다. 즉, 본인 소유의 인프라 또는 서면으로 명시적인 허가를 받은 시스템만 대상으로 해야 합니다. 이 도구는 읽기 전용 핑거프린팅 을 수행하며 취약점을 악용하지 않습니다. 테스트 범위를 준수하고 관련 법률 및 책임 있는 공개responsible...

RockyLinux 10 : openssl (RLSA-2026:67154)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67154 advisory. openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-14456 openssl: QUIC server may trigger double free when...

openssl: QUIC ACK-only packet retention can cause memory exhaustion

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory...

CVE-2026-78662

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

USN-8678-3: OpenSSL vulnerability

USN-8673-1 fixed vulnerabilities in OpenSSL. The update inadvertently left out the fix for CVE-2026-75803 in Ubuntu 26.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that OpenSSL incorrectly handled the QUIC server incoming...

CVE-2026-78966

A flaw was found in Google Chrome. An externally controlled reference within the QUIC protocol could allow a remote attacker to bypass the web origin policy. This vulnerability can be exploited by enticing a user to visit a specially crafted HTML page. The bypass of the web origin policy could le...

openssl: QUIC ACK-only packet retention can cause memory exhaustion

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory...

CVE-2026-63075

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory...

PT-2026-81524

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An information leak exists in the QUIC protocol, which is a transport layer network protocol designed to reduce connection latency. A remote attacker can leak sensitive information by...

OpenSSL -- Multiple vulnerabilities

The OpenSSL poject reports: Heap Buffer Overflow in CMS Key Unwrapping CVE-2026-63072 Moderate Invalid Pointer Dereference in CMP Server via Crafted protectionAlg CVE-2026-63076 Moderate RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate CVE-2026-14457 Low Excessive...

CVE-2026-63075

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

Astra Linux – Vulnerability in Chromium

The use of “after free” in QUIC in Google Chrome before version 124.0.6367.60 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox

Data was not properly sanitized during the decoding of a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. This vulnerability affects Firefox versions earlier than 124...

CVE-2026-25800

A flaw was found in Quinn, a Rust implementation of the QUIC transport protocol. A remote attacker can exploit this vulnerability by sending specially crafted QUIC stream fragments with many gaps. This can lead to high buffer overhead in the Assembler component, causing memory exhaustion and a...

CVE-2026-17673

Integer overflow in QUIC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-17733

Inappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...