CVE-2026-14456

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14456
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14456.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14456
Downstream
Published
2026-08-13T13:55:52.370Z
Modified
2026-08-15T16:52:29.017325Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Unbounded Memory Growth in QUIC Server Incoming Channel Queue
Details

Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit.

Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service.

CWE: CWE-770: Allocation of Resources Without Limits or Throttling

Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSLaccept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSLaccept() frequently enough to serve these inbound connection requests.

The issue is present since OpenSSL 3.5 when the QUIC server implementation was added.

The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSLsetvalue_uint(3ossl).

FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.0.2"
                },
                {
                    "introduced": "3.6.0"
                },
                {
                    "fixed": "3.6.4"
                },
                {
                    "introduced": "3.5.0"
                },
                {
                    "fixed": "3.5.8"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "openssl",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14456.json"
}
References

Affected packages

Git / github.com/openssl/openssl

Affected ranges

Type
GIT
Repo
https://github.com/openssl/openssl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
08e7756c3900bcfd77a720e7b74e27d6e4ed01a9
Fixed
4084152e040329ca0194c4c1750b9b46d00a5b6b
Fixed
f2f1465f2d2e5c61dfeac4d20fd093797d821139
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

3.*
3.5-POST-CLANG-FORMAT-WEBKIT
3.5-PRE-CLANG-FORMAT-WEBKIT
3.6-POST-CLANG-FORMAT-WEBKIT
3.6-PRE-CLANG-FORMAT-WEBKIT
4.*
4.0-POST-CLANG-FORMAT-WEBKIT
4.0-PRE-CLANG-FORMAT-WEBKIT
Other
BEFORE_engine
OpenSSL_0_9_1c
OpenSSL_0_9_2b
OpenSSL_0_9_3
OpenSSL_0_9_3a
OpenSSL_0_9_3beta2
OpenSSL_0_9_4
OpenSSL_0_9_5a
OpenSSL_0_9_5a-beta1
OpenSSL_0_9_5a-beta2
OpenSSL_0_9_5beta1
OpenSSL_0_9_5beta2
OpenSSL_0_9_6-beta3
OpenSSL_1_1_0-pre1
OpenSSL_1_1_0-pre2
OpenSSL_1_1_0-pre3
OpenSSL_1_1_0-pre4
OpenSSL_1_1_0-pre5
OpenSSL_1_1_0-pre6
OpenSSL_1_1_1
OpenSSL_1_1_1-pre1
OpenSSL_1_1_1-pre2
OpenSSL_1_1_1-pre3
OpenSSL_1_1_1-pre4
OpenSSL_1_1_1-pre5
OpenSSL_1_1_1-pre6
OpenSSL_1_1_1-pre7
OpenSSL_1_1_1-pre8
OpenSSL_1_1_1-pre9
master-post-auto-reformat
master-post-reformat
master-pre-auto-reformat
master-pre-reformat
openssl-3.*
openssl-3.0.0-alpha1
openssl-3.0.0-alpha10
openssl-3.0.0-alpha11
openssl-3.0.0-alpha12
openssl-3.0.0-alpha13
openssl-3.0.0-alpha14
openssl-3.0.0-alpha15
openssl-3.0.0-alpha16
openssl-3.0.0-alpha17
openssl-3.0.0-alpha2
openssl-3.0.0-alpha3
openssl-3.0.0-alpha4
openssl-3.0.0-alpha5
openssl-3.0.0-alpha6
openssl-3.0.0-alpha7
openssl-3.0.0-alpha8
openssl-3.0.0-alpha9
openssl-3.0.0-beta1
openssl-3.0.0-beta2
openssl-3.2.0-alpha1
openssl-3.2.0-alpha2
openssl-3.4.0-alpha1
openssl-3.5.0
openssl-3.5.0-alpha1
openssl-3.5.0-beta1
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
openssl-3.5.4
openssl-3.5.5
openssl-3.5.6
openssl-3.5.7
openssl-3.6.0
openssl-3.6.0-alpha1
openssl-3.6.0-beta1
openssl-3.6.1
openssl-3.6.2
openssl-3.6.3
openssl-4.*
openssl-4.0.0
openssl-4.0.0-alpha1
openssl-4.0.0-beta1
openssl-4.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14456.json"
vanir_signatures 
[
    {
        "target": {
            "function": "ossl_quic_port_new",
            "file": "ssl/quic/quic_port.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b",
        "id": "CVE-2026-14456-04fe94a9",
        "signature_version": "v1",
        "digest": {
            "length": 484.0,
            "function_hash": "152298189674075361688642704687157376484"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "expect_quic_for_value",
            "file": "ssl/quic/quic_impl.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9",
        "id": "CVE-2026-14456-0516d369",
        "signature_version": "v1",
        "digest": {
            "length": 331.0,
            "function_hash": "98313004643330115520943070715735741607"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "include/internal/quic_port.h"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b",
        "id": "CVE-2026-14456-0f108767",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "283955993399844781435185125391632170713",
                "66997568548755437359947665907351340716"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "ssl/quic/quic_port.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9",
        "id": "CVE-2026-14456-1a1968c5",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "127447272492966831777046441267912061689",
                "207696824732731389639572734502416992416",
                "263313600752934211079062412412156493849",
                "259639210825664004689443772714126528742",
                "133449213124293360717354397738632833440",
                "178331997951778216193112585036511133093",
                "238390184026904420224440414772506613441",
                "198904153456458740012905179551324085281",
                "249704468801513673027469958307834485141",
                "328203968560099518970369073730078658832",
                "298150452915282983409304347210481431519"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "ossl_quic_get_value_uint",
            "file": "ssl/quic/quic_impl.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b",
        "id": "CVE-2026-14456-1d1ffab1",
        "signature_version": "v1",
        "digest": {
            "length": 1270.0,
            "function_hash": "187287412614650548064651686981985965135"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "ossl_quic_get_value_uint",
            "file": "ssl/quic/quic_impl.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9",
        "id": "CVE-2026-14456-2052b66e",
        "signature_version": "v1",
        "digest": {
            "length": 1270.0,
            "function_hash": "187287412614650548064651686981985965135"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "port_default_packet_handler",
            "file": "ssl/quic/quic_port.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9",
        "id": "CVE-2026-14456-2f3ec35c",
        "signature_version": "v1",
        "digest": {
            "length": 2479.0,
            "function_hash": "235857077784850240524595493989450745790"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "port_default_packet_handler",
            "file": "ssl/quic/quic_port.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b",
        "id": "CVE-2026-14456-32592951",
        "signature_version": "v1",
        "digest": {
            "length": 2479.0,
            "function_hash": "235857077784850240524595493989450745790"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "include/internal/quic_port.h"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139",
        "id": "CVE-2026-14456-4ae0dcb7",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "283955993399844781435185125391632170713",
                "66997568548755437359947665907351340716"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "ssl/quic/quic_port.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139",
        "id": "CVE-2026-14456-4d58ec2d",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "127447272492966831777046441267912061689",
                "207696824732731389639572734502416992416",
                "263313600752934211079062412412156493849",
                "214179851359437742666655250510188609352",
                "14876342721769314201069611571037310541",
                "164334596802494320768525008913954025657",
                "159955446981634787493935169857845617560",
                "198904153456458740012905179551324085281",
                "249704468801513673027469958307834485141",
                "328203968560099518970369073730078658832",
                "298150452915282983409304347210481431519"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "expect_quic_for_value",
            "file": "ssl/quic/quic_impl.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b",
        "id": "CVE-2026-14456-5b211f8c",
        "signature_version": "v1",
        "digest": {
            "length": 331.0,
            "function_hash": "98313004643330115520943070715735741607"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "expect_quic_for_value",
            "file": "ssl/quic/quic_impl.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139",
        "id": "CVE-2026-14456-78ab08f4",
        "signature_version": "v1",
        "digest": {
            "length": 331.0,
            "function_hash": "98313004643330115520943070715735741607"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "ossl_quic_port_new",
            "file": "ssl/quic/quic_port.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139",
        "id": "CVE-2026-14456-8db8a54d",
        "signature_version": "v1",
        "digest": {
            "length": 464.0,
            "function_hash": "140269799276900777752405038766524929506"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "ossl_quic_set_value_uint",
            "file": "ssl/quic/quic_impl.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139",
        "id": "CVE-2026-14456-91d7603b",
        "signature_version": "v1",
        "digest": {
            "length": 433.0,
            "function_hash": "75318336328397738474977415838708951656"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "ssl/quic/quic_impl.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139",
        "id": "CVE-2026-14456-9461466d",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "173151801817972153598185864185634163844",
                "337175273814747017794212328477188284766",
                "337476107502584597648425264966286441221",
                "53109360322568627251302881712897159814",
                "49597157704268252314248260180141227454",
                "87708154624208306113405495001684628226",
                "153659877132169705337182315905457463438",
                "277660774243503699899894854579028755949",
                "146731031659043871887801921751293971746",
                "227478790602546851360465222349645972836",
                "198593513978428259675651271683478331098",
                "294669460219480883223449174445239403750",
                "77746380011293567614349931223189732387",
                "48623909572190873751849815751492669569",
                "317330302377552289112813969320299287569",
                "143768461503211377278087979466497572847",
                "123440928055915924103716073270138430986",
                "109444791942819383623229476164103867889"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "ossl_quic_set_value_uint",
            "file": "ssl/quic/quic_impl.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9",
        "id": "CVE-2026-14456-9a7f8439",
        "signature_version": "v1",
        "digest": {
            "length": 433.0,
            "function_hash": "75318336328397738474977415838708951656"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "ssl/quic/quic_port_local.h"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9",
        "id": "CVE-2026-14456-a508ca35",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "209448326493946565660002278807781826238",
                "134894082087796703171720852004921887731",
                "198348284796264661801711985795887862473",
                "39189457397899046204216189304770462152"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "ssl/quic/quic_port.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b",
        "id": "CVE-2026-14456-a84c7141",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "127447272492966831777046441267912061689",
                "207696824732731389639572734502416992416",
                "263313600752934211079062412412156493849",
                "259639210825664004689443772714126528742",
                "133449213124293360717354397738632833440",
                "178331997951778216193112585036511133093",
                "238390184026904420224440414772506613441",
                "198904153456458740012905179551324085281",
                "249704468801513673027469958307834485141",
                "328203968560099518970369073730078658832",
                "298150452915282983409304347210481431519"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "ossl_quic_get_value_uint",
            "file": "ssl/quic/quic_impl.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139",
        "id": "CVE-2026-14456-b43eac14",
        "signature_version": "v1",
        "digest": {
            "length": 1270.0,
            "function_hash": "187287412614650548064651686981985965135"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "port_default_packet_handler",
            "file": "ssl/quic/quic_port.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139",
        "id": "CVE-2026-14456-b702642f",
        "signature_version": "v1",
        "digest": {
            "length": 2479.0,
            "function_hash": "235857077784850240524595493989450745790"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "ossl_quic_set_value_uint",
            "file": "ssl/quic/quic_impl.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b",
        "id": "CVE-2026-14456-bb6f48e3",
        "signature_version": "v1",
        "digest": {
            "length": 433.0,
            "function_hash": "75318336328397738474977415838708951656"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "ssl/quic/quic_impl.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9",
        "id": "CVE-2026-14456-d39db4ea",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "264042437527465570916912235492892512035",
                "235091889006994744792877550066441725866",
                "337476107502584597648425264966286441221",
                "53109360322568627251302881712897159814",
                "49597157704268252314248260180141227454",
                "87708154624208306113405495001684628226",
                "153659877132169705337182315905457463438",
                "277660774243503699899894854579028755949",
                "146731031659043871887801921751293971746",
                "227478790602546851360465222349645972836",
                "198593513978428259675651271683478331098",
                "294669460219480883223449174445239403750",
                "77746380011293567614349931223189732387",
                "48623909572190873751849815751492669569",
                "317330302377552289112813969320299287569",
                "143768461503211377278087979466497572847",
                "123440928055915924103716073270138430986",
                "109444791942819383623229476164103867889"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "include/internal/quic_port.h"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9",
        "id": "CVE-2026-14456-d4018fdb",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "283955993399844781435185125391632170713",
                "66997568548755437359947665907351340716"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "ssl/quic/quic_impl.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b",
        "id": "CVE-2026-14456-dc94c3e0",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "264042437527465570916912235492892512035",
                "235091889006994744792877550066441725866",
                "337476107502584597648425264966286441221",
                "53109360322568627251302881712897159814",
                "49597157704268252314248260180141227454",
                "87708154624208306113405495001684628226",
                "153659877132169705337182315905457463438",
                "277660774243503699899894854579028755949",
                "146731031659043871887801921751293971746",
                "227478790602546851360465222349645972836",
                "198593513978428259675651271683478331098",
                "294669460219480883223449174445239403750",
                "77746380011293567614349931223189732387",
                "48623909572190873751849815751492669569",
                "317330302377552289112813969320299287569",
                "143768461503211377278087979466497572847",
                "123440928055915924103716073270138430986",
                "109444791942819383623229476164103867889"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "ssl/quic/quic_port_local.h"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139",
        "id": "CVE-2026-14456-dd44c922",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "291625363914164838436188225720507322651",
                "90649636119339903077193033279182033345",
                "118093034802866332811309130124420911763",
                "39189457397899046204216189304770462152"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "ssl/quic/quic_port_local.h"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b",
        "id": "CVE-2026-14456-e8d75c43",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "209448326493946565660002278807781826238",
                "134894082087796703171720852004921887731",
                "198348284796264661801711985795887862473",
                "39189457397899046204216189304770462152"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "ossl_quic_port_new",
            "file": "ssl/quic/quic_port.c"
        },
        "deprecated": false,
        "source": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9",
        "id": "CVE-2026-14456-fb97a66d",
        "signature_version": "v1",
        "digest": {
            "length": 484.0,
            "function_hash": "152298189674075361688642704687157376484"
        },
        "signature_type": "Function"
    }
]
vanir_signatures_modified 
"2026-08-15T16:52:29Z"