{"id":"CVE-2026-95691","published":"2026-11-10T19:21:39.377","lastModified":"2026-11-10T22:10:04.727","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage\nwhile the TLS record layer retains a direct pointer into that storage causing\nuse after free.\n\nImpact summary: A malicious QUIC server can cause a heap-use-after-free read\nin the OpenSSL QUIC client. The server can also identify one allocator-adjacent\nbyte through the client's protected Handshake response.\n\nCWE: CWE-416: Use After Free\n\nDescription: During CRYPTO stream processing, a pointer into the first frame's\nmemory on the stream is lent to the TLS handshake processing. The memory\nmust remain stable until it is processed and released. However the processing\nof retransmitted CRYPTO frames could release the memory if the retransmitted\nframe fully overlapped the existing frame. This then causes use-after-free read\nwhen the TLS handshake processing continues.\n\nThe use-after-free read can lead to a Denial-of-Service of the client\napplication or a minor leak of information about the heap memory contents\nthat might be overwritten with other data, subsequently allocated by\nthe application, to the peer.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-416"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","tags":[]},{"url":"https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386","tags":[]},{"url":"https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f","tags":[]},{"url":"https://openssl-library.org/news/secadv/20261110.txt","tags":[]}],"exploitRefs":[{"url":"https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","tags":[]},{"url":"https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386","tags":[]},{"url":"https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f","tags":[]}],"hasPoc":true,"ai":null}