openssl

OpenSSL 프로젝트에 오신 것을 환영합니다 OpenSSL은 전송 계층 보안TLS, 이전 명칭 SSL, 데이터그램 TLSDTLS 및 QUIC 프로토콜을 위한 강력하고 상용 등급의 모든 기능을 갖춘 오픈 소스 툴킷입니다. 프로토콜 구현은 완전한 강도의 범용 암호화 라이브러리를 기반으로 하며, 이 라이브러리는 독립적으로도 사용할 수 있습니다. 또한 FIPS 표준을 준수하도록 검증된 암호화 모듈도 포함되어 있습니다. OpenSSL은 Eric A. Young과 Tim J. Hudson이 개발한 SSLeay 라이브러리에서 파생되었습니...

ssh3

!NOTE SSH3는 아마 이름이 변경될 것입니다. 여전히 HTTP/3 Extended connect 위에서 실행되는 SSH 연결 프로토콜RFC4254이지만, 필요한 변경 사항이 많고 널리 사용되는 SSH 구현체의 철학과 너무 거리가 있어 통합을 고려하기 어렵습니다. 사양 초안은 이미 "HTTP/3을 통한 원격 터미널"로 이름이 변경되었지만, 좋은 영구적인 이름을 정하는 데 시간이 필요합니다. SSH3: HTTP/3를 사용한 더 빠르고 풍부한 보안 셸 SSH3는 SSH 프로토콜을 완전히 재검토하여 그 의미를 HTTP 메커니즘 ...

CVE-2025-54939

LSQUIC における QUIC-LEAK CVE-2025-54939 の PoC 概要 この PoC は、LSQUIC QUIC 実装におけるハンドシェイク前のメモリ枯渇（サービス拒否）脆弱性である CVE-2025-54939 を紹介します。 QUIC-LEAK と名付けられたこの問題は、Imperva によって最初に文書化されました:...

CVE-2026-6060-QUIC-Handshake-Amplification-via-Address-Validation-Bypass

CVE-2026-6060 – アドレス検証バイパスによるQUICハンドシェイク増幅 プログラムコード（Pythonシミュレーション） quicserversim.py - Vulnerable QUIC server simulated handshake import socket def sendquicinitialconn, addr, serversalt: Respond with a large "server hello" without validating source address In real QUIC, the server must echo the...

CVE-2026-4253-Scanner

CVE-2026-42530 — Safe-Check 扫描器 针对 NGINX HTTP/3（QUIC）释放后使用漏洞的非破坏性批量扫描器 在不触发漏洞的前提下，盘点你的哪些主机存在风险。 ⚠️ 免责声明 本工具仅用于授权的安全测试 ——测试你自己的基础设施，或你有明确书面授权进行评估的系统。它执行只读指纹识别 ，并不会 利用漏洞。你有责任确保测试在授权范围内，并遵守适用法律及负责任的披露原则。作者不对滥用行为承担任何责任。 🔍 关于漏洞 CVE-2026-42530 是 NGINX 的 ngxhttpv3module 中存在的释放后使用漏洞（CWE-416）。当 NGINX 配置为提供...

openssl: openssl: Denial of Service via excessive QUIC packet buffer retention

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by sending specially crafted network packets to a QUIC protocol endpoint. Because the QUIC stack retains memory in packet buffers until the receiving application reads the stream data, an attacker can manipulate data...

The vulnerability of the QUIC protocol implementation in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the QUIC protocol implementation in Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

RockyLinux 10 : openssl (RLSA-2026:67154)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67154 advisory. openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-14456 openssl: QUIC server may trigger double free when...

Astra Linux – Vulnerability in Chromium

The use of “after free” in QUIC in Google Chrome before version 124.0.6367.60 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox

Data was not properly sanitized during the decoding of a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. This vulnerability affects Firefox versions earlier than 124...

openssl: QUIC ACK-only packet retention can cause memory exhaustion

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory...

CVE-2026-78662

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

USN-8678-3: OpenSSL vulnerability

USN-8673-1 fixed vulnerabilities in OpenSSL. The update inadvertently left out the fix for CVE-2026-75803 in Ubuntu 26.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that OpenSSL incorrectly handled the QUIC server incoming...

CVE-2026-78966

A flaw was found in Google Chrome. An externally controlled reference within the QUIC protocol could allow a remote attacker to bypass the web origin policy. This vulnerability can be exploited by enticing a user to visit a specially crafted HTML page. The bypass of the web origin policy could le...

openssl: QUIC ACK-only packet retention can cause memory exhaustion

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory...

CVE-2026-63075

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory...

PT-2026-81524

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An information leak exists in the QUIC protocol, which is a transport layer network protocol designed to reduce connection latency. A remote attacker can leak sensitive information by...

CVE-2026-63075

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC...

OpenSSL -- Multiple vulnerabilities

The OpenSSL poject reports: Heap Buffer Overflow in CMS Key Unwrapping CVE-2026-63072 Moderate Invalid Pointer Dereference in CMP Server via Crafted protectionAlg CVE-2026-63076 Moderate RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate CVE-2026-14457 Low Excessive...

CVE-2026-25800

A flaw was found in Quinn, a Rust implementation of the QUIC transport protocol. A remote attacker can exploit this vulnerability by sending specially crafted QUIC stream fragments with many gaps. This can lead to high buffer overhead in the Assembler component, causing memory exhaustion and a...