{"id":"CVE-2026-95691","kind":"vulnerability","aliases":["CVE-2026-95691"],"related":[],"title":"OpenSSL QUIC client: retransmitted CRYPTO frame causes use-after-free read (DoS or one-byte leak)","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage\nwhile the TLS record layer retains a direct pointer into that storage causing\nuse after free.\n\nImpact summary: A malicious QUIC server can cause a heap-use-after-free read\nin the OpenSSL QUIC client. The server can also identify one allocator-adjacent\nbyte through the client's protected Handshake response.\n\nCWE: CWE-416: Use After Free\n\nDescription: During CRYPTO stream processing, a pointer into the first frame's\nmemory on the stream is lent to the TLS handshake processing. The memory\nmust remain stable until it is processed and released. However the processing\nof retransmitted CRYPTO frames could release the memory if the retransmitted\nframe fully overlapped the existing frame. This then causes use-after-free read\nwhen the TLS handshake processing continues.\n\nThe use-after-free read can lead to a Denial-of-Service of the client\napplication or a minor leak of information about the heap memory contents\nthat might be overwritten with other data, subsequently allocated by\nthe application, to the peer.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.","summary":"A retransmitted QUIC CRYPTO frame can free memory that the TLS layer still points to, causing a use-after-free read in the OpenSSL QUIC client. A malicious QUIC server can crash the client or leak one byte of heap memory.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"openssl","fixed":["3.5.10","4.0.4","4.1.1"],"affected":">= 3.5.0, < 3.5.10; >= 4.0.0, < 4.0.4; >= 4.1.0, < 4.1.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["c","http3","openssl","openssl-quic-client","package","quic"],"not_affected_if":["fips-module","no-quic-client","tcp-only"],"how_to_check":"- Run 'openssl version' and check the library your app links against: affected are 4.1.0, 4.0.0-4.0.3 and 3.5.0-3.5.9.\n- Only matters if your code or a dependency uses OpenSSL's QUIC client (SSL_new with the QUIC client method, i.e. outbound HTTP/3 or QUIC connections made through OpenSSL). TCP TLS and the FIPS module are not affected.\n- Also check if you ship a distro or vendored OpenSSL build: confirm with the distributor that the backport of the fix is in. Versions outside 3.5, 4.0 and 4.1 are not listed by the vendor; confirm with them.","fix":"Upgrade OpenSSL to 4.1.1 (4.1.x), 4.0.4 (4.0.x) or 3.5.10 (3.5.x).","status":"open","published_at":"2026-11-10T19:21:39+00:00","first_seen_at":"2026-11-10T19:25:22+00:00","triaged_at":"2026-11-10T20:04:44+00:00","updated_at":"2026-11-10T20:34:38+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-10T20:04:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OpenSSL: retransmitted QUIC frame causes use-after-free in client","impact":"low","summary":"A retransmitted QUIC CRYPTO frame can free memory that the TLS layer still points to, causing a use-after-free read in the OpenSSL QUIC client. A malicious QUIC server can crash the client or leak one byte of heap memory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openssl","quic","http3","c"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"client crashes or leaks one heap byte to malicious server","analyst_note":"Confirm affected OpenSSL version ranges and fixed versions from the NVD entry and the linked GitHub patch commits.","how_to_check":"- Check whether the application uses OpenSSL's QUIC client (SSL_new with QUIC support) by looking for QUIC connections in client code\n- Check the linked OpenSSL version with `openssl version`\n- Check whether the team's OpenSSL build includes the QUIC client (unknown if the sources list affected ranges)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-quic-client","tcp-only","fips-module"],"who_is_affected":"Only the OpenSSL QUIC client is described; the sources do not state affected version ranges. Systems that make outbound QUIC/HTTP3 connections to servers they do not fully trust are the exposed ones. TLS over TCP and the FIPS module are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000778,"input_tokens":4889,"output_tokens":579,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm affected OpenSSL version ranges and fixed versions from the NVD entry and the linked GitHub patch commits.","search":"'-2026':20A,23A '-416':143C '-95691':21A,24A 'adjac':132C 'affect':267C 'alloc':131C,252C 'allocator-adjac':130C 'also':127C 'applic':232C,255C 'boundari':279C 'byte':17A,73B,133C 'c':26B 'caus':7A,50B,100C,111C,203C 'client':3A,32B,61B,69B,123C,136C,231C 'content':243C 'continu':214C 'could':188C 'crash':67B 'crypto':5A,38B,82C,149C,186C 'cve':19A,22A 'cwe':141C,142C 'data':250C 'denial':226C 'denial-of-servic':225C 'descript':147C 'direct':95C 'dos':13A 'exist':199C 'fip':259C,263C,277C 'first':156C 'frame':6A,39B,83C,157C,187C,195C,200C 'free':11A,41B,55B,103C,117C,146C,207C,219C 'fulli':196C 'handshak':139C,168C,212C 'heap':75B,114C,241C 'heap-use-after-fre':113C 'howev':181C 'http3':27B 'identifi':128C 'impact':104C,260C 'implement':271C 'inform':238C 'issu':77C 'layer':46B,92C 'lead':222C 'leak':18A,71B,236C 'lent':164C 'malici':63B,107C 'memori':42B,76B,159C,171C,191C,242C 'might':245C 'minor':235C 'modul':264C,278C 'must':172C 'one':16A,72B,129C 'one-byt':15A 'openssl':1A,25A,28B,30B,59B,121C,276C 'openssl-quic-cli':29B 'outsid':273C 'overlap':197C 'overwritten':247C 'packag':33B 'packet':86C 'peer':258C 'point':48B 'pointer':96C,153C 'process':151C,169C,178C,183C,213C 'protect':138C 'quic':2A,31B,34B,37B,60B,64B,81C,108C,122C,270C 'read':12A,56B,118C,208C,220C 'record':91C 'releas':85C,180C,189C 'remain':173C 'respons':140C 'retain':93C 'retransmit':4A,36B,80C,185C,194C 'server':65B,109C,125C 'servic':228C 'stabl':174C 'still':47B 'storag':87C,99C 'stream':150C,162C 'subsequ':251C 'summari':78C,105C 'tls':45B,90C,167C,211C 'use':9A,53B,101C,115C,144C,205C,217C 'use-after-fre':8A,52B,204C,216C","nicknames":[],"mitigations":[],"who_affected":"Applications that use OpenSSL's own QUIC client to connect to servers (HTTP/3 or other QUIC), on OpenSSL 3.5.0-3.5.9, 4.0.0-4.0.3 or 4.1.0. A malicious QUIC server can crash the client or learn one heap byte. TLS over TCP, QUIC servers, and the FIPS module are not listed as affected; skip it if you do not use OpenSSL's QUIC client.","tier":"B","verified":{"fix":{"at":"2026-11-10T20:34:38Z","by":"analyst","doc":"https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","run_id":2674},"products":{"at":"2026-11-10T20:34:38Z","by":"analyst","doc":"https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","run_id":2674}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openssl"],"ptokens":["openssl"],"labels":["c","http3","low","openssl","opensslquicclient","package","quic"],"campaign_type":null,"search_a":"'-2026':20A,23A '-95691':21A,24A 'byte':17A 'caus':7A 'client':3A 'crypto':5A 'cve':19A,22A 'dos':13A 'frame':6A 'free':11A 'leak':18A 'one':16A 'one-byt':15A 'openssl':1A,25A 'quic':2A 'read':12A 'retransmit':4A 'use':9A 'use-after-fre':8A","search_b":"'byte':73B 'c':26B 'caus':50B 'client':32B,61B,69B 'crash':67B 'crypto':38B 'frame':39B 'free':41B,55B 'heap':75B 'http3':27B 'layer':46B 'leak':71B 'malici':63B 'memori':42B,76B 'one':72B 'openssl':28B,30B,59B 'openssl-quic-cli':29B 'packag':33B 'point':48B 'quic':31B,34B,37B,60B,64B 'read':56B 'retransmit':36B 'server':65B 'still':47B 'tls':45B 'use':53B 'use-after-fre':52B","search_c":"'-416':143C 'adjac':132C 'affect':267C 'alloc':131C,252C 'allocator-adjac':130C 'also':127C 'applic':232C,255C 'boundari':279C 'byte':133C 'caus':100C,111C,203C 'client':123C,136C,231C 'content':243C 'continu':214C 'could':188C 'crypto':82C,149C,186C 'cwe':141C,142C 'data':250C 'denial':226C 'denial-of-servic':225C 'descript':147C 'direct':95C 'exist':199C 'fip':259C,263C,277C 'first':156C 'frame':83C,157C,187C,195C,200C 'free':103C,117C,146C,207C,219C 'fulli':196C 'handshak':139C,168C,212C 'heap':114C,241C 'heap-use-after-fre':113C 'howev':181C 'identifi':128C 'impact':104C,260C 'implement':271C 'inform':238C 'issu':77C 'layer':92C 'lead':222C 'leak':236C 'lent':164C 'malici':107C 'memori':159C,171C,191C,242C 'might':245C 'minor':235C 'modul':264C,278C 'must':172C 'one':129C 'openssl':121C,276C 'outsid':273C 'overlap':197C 'overwritten':247C 'packet':86C 'peer':258C 'pointer':96C,153C 'process':151C,169C,178C,183C,213C 'protect':138C 'quic':81C,108C,122C,270C 'read':118C,208C,220C 'record':91C 'releas':85C,180C,189C 'remain':173C 'respons':140C 'retain':93C 'retransmit':80C,185C,194C 'server':109C,125C 'servic':228C 'stabl':174C 'storag':87C,99C 'stream':150C,162C 'subsequ':251C 'summari':78C,105C 'tls':90C,167C,211C 'use':101C,115C,144C,205C,217C 'use-after-fre':204C,216C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95691","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95691","severity":null,"published_at":"2026-11-10T19:21:39+00:00","modified_at":"2026-11-10T19:21:39+00:00","first_seen_at":"2026-11-10T19:25:22+00:00","fetched_at":"2026-11-10T19:25:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95691:2674","url":"https://openssl-library.org/news/vulnerabilities/","severity":null,"published_at":"2026-11-10T20:34:38+00:00","modified_at":"2026-11-10T20:34:38+00:00","first_seen_at":"2026-11-10T20:34:38+00:00","fetched_at":"2026-11-10T20:34:38+00:00","note":"Read OpenSSL vulnerabilities page (vendor): affected/fixed versions, vendor severity Low (triage had high, lowered per vendor rating); commits confirm fix by range locking, reported by Filipe Casal. No X/web search done (web-cli unavailable); no exploitation or PoC seen.","cites":["https://openssl-library.org/news/vulnerabilities/"]}],"documents":[{"id":117522,"url":"https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117523,"url":"https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117524,"url":"https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":118044,"url":"https://openssl-library.org/news/vulnerabilities/","title":"OpenSSL vulnerabilities: CVE-2026-95691","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}