CVE-2026-88822

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-88822
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88822.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-88822
Downstream
Published
2026-11-10T18:15:38Z
Modified
2026-11-12T07:07:33Z
Summary
QUIC Uses Uninitialized Stack Bytes During Automated Peer Detection
Details

Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is then used as the destination for outgoing packets.

Impact summary: Applications using QUIC's automated peer detection mechanism may receive an invalid address, leading to connection loss and disclosure of uninitialized stack data to an attacker observing the outgoing network traffic.

CWE: CWE-457 (Use of Uninitialized Variable)

Description: The OpenSSL QUIC stack contains a feature in which, when using an already connected socket, it will auto-detect the peer address during the SSL handshake. This feature uses the getpeername() function, passing a buffer of sufficient length to hold any supported address family, but passes a buffer length that is only sized such that larger addresses, such as IPv6, cannot be retrieved. The getpeername() function however, still returns the full address length, which is accepted as the valid input buffer length, leading to the address buffer containing uninitialized stack data instead of the actual peer address. The invalid peer address is then used as destination for the outgoing packets which leads to a connectivity breakage and a leakage of the uninitialized stack data to passive network observers.

FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected protocol is not implemented in the FIPS module.

Database specific 
{
    "cna_assigner": "openssl",
    "cwe_ids": [
        "CWE-457"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88822.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "4.1.0"
                        },
                        {
                            "fixed": "4.1.1"
                        },
                        {
                            "introduced": "4.0.0"
                        },
                        {
                            "fixed": "4.0.4"
                        },
                        {
                            "introduced": "3.5.0"
                        },
                        {
                            "fixed": "3.5.10"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/openssl/openssl

Affected ranges

Type
GIT
Repo
https://github.com/openssl/openssl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7b4f5344aa0401e7b777640050b5257ed2a70e88
Fixed
911eee8eb7550b95a206f1ad8cbdb986098982f3
Fixed
1a73dc590cbad62d6f0329ea4779eadaa8d8fd75
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "7b4f5344aa0401e7b777640050b5257ed2a70e88"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "911eee8eb7550b95a206f1ad8cbdb986098982f3"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "1a73dc590cbad62d6f0329ea4779eadaa8d8fd75"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*
3.5-POST-CLANG-FORMAT-WEBKIT
3.5-PRE-CLANG-FORMAT-WEBKIT
4.*
4.0-POST-CLANG-FORMAT-WEBKIT
4.0-PRE-CLANG-FORMAT-WEBKIT
Other
BEFORE_engine
OpenSSL_0_9_1c
OpenSSL_0_9_2b
OpenSSL_0_9_3
OpenSSL_0_9_3a
OpenSSL_0_9_3beta2
OpenSSL_0_9_4
OpenSSL_0_9_5a
OpenSSL_0_9_5a-beta1
OpenSSL_0_9_5a-beta2
OpenSSL_0_9_5beta1
OpenSSL_0_9_5beta2
OpenSSL_0_9_6-beta3
OpenSSL_1_1_0-pre1
OpenSSL_1_1_0-pre2
OpenSSL_1_1_0-pre3
OpenSSL_1_1_0-pre4
OpenSSL_1_1_0-pre5
OpenSSL_1_1_0-pre6
OpenSSL_1_1_1
OpenSSL_1_1_1-pre1
OpenSSL_1_1_1-pre2
OpenSSL_1_1_1-pre3
OpenSSL_1_1_1-pre4
OpenSSL_1_1_1-pre5
OpenSSL_1_1_1-pre6
OpenSSL_1_1_1-pre7
OpenSSL_1_1_1-pre8
OpenSSL_1_1_1-pre9
master-post-auto-reformat
master-post-reformat
master-pre-auto-reformat
master-pre-reformat
openssl-3.*
openssl-3.0.0-alpha1
openssl-3.0.0-alpha10
openssl-3.0.0-alpha11
openssl-3.0.0-alpha12
openssl-3.0.0-alpha13
openssl-3.0.0-alpha14
openssl-3.0.0-alpha15
openssl-3.0.0-alpha16
openssl-3.0.0-alpha17
openssl-3.0.0-alpha2
openssl-3.0.0-alpha3
openssl-3.0.0-alpha4
openssl-3.0.0-alpha5
openssl-3.0.0-alpha6
openssl-3.0.0-alpha7
openssl-3.0.0-alpha8
openssl-3.0.0-alpha9
openssl-3.0.0-beta1
openssl-3.0.0-beta2
openssl-3.2.0-alpha1
openssl-3.2.0-alpha2
openssl-3.4.0-alpha1
openssl-3.5.0
openssl-3.5.0-alpha1
openssl-3.5.0-beta1
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
openssl-3.5.4
openssl-3.5.5
openssl-3.5.6
openssl-3.5.7
openssl-3.5.8
openssl-3.5.9
openssl-4.*
openssl-4.0.0
openssl-4.0.0-alpha1
openssl-4.0.0-beta1
openssl-4.0.1
openssl-4.0.2
openssl-4.0.3
openssl-4.1.0
openssl-4.1.0-alpha1
openssl-4.1.0-beta1
openssl-4.1.0-beta2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88822.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "334055272529136200699713801284958124274",
                "107244887741943492582204868014768324337",
                "108209324142584847172683935405237115125",
                "207523137777363619146879986736380532010",
                "212426496692392723095441304299994324763"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-88822-3613dcea",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75",
        "target": {
            "file": "crypto/bio/bss_dgram.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "334055272529136200699713801284958124274",
                "107244887741943492582204868014768324337",
                "108209324142584847172683935405237115125",
                "207523137777363619146879986736380532010",
                "212426496692392723095441304299994324763"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-88822-77ca6053",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88",
        "target": {
            "file": "crypto/bio/bss_dgram.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "53526856867199075137812096352386634189",
            "length": 10961
        },
        "id": "CVE-2026-88822-9c7d4a0f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75",
        "target": {
            "file": "crypto/bio/bss_dgram.c",
            "function": "dgram_ctrl"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "334055272529136200699713801284958124274",
                "107244887741943492582204868014768324337",
                "108209324142584847172683935405237115125",
                "207523137777363619146879986736380532010",
                "212426496692392723095441304299994324763"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-88822-cd42855a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3",
        "target": {
            "file": "crypto/bio/bss_dgram.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "53526856867199075137812096352386634189",
            "length": 10961
        },
        "id": "CVE-2026-88822-de5527b3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3",
        "target": {
            "file": "crypto/bio/bss_dgram.c",
            "function": "dgram_ctrl"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "53526856867199075137812096352386634189",
            "length": 10961
        },
        "id": "CVE-2026-88822-e9d874cb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88",
        "target": {
            "file": "crypto/bio/bss_dgram.c",
            "function": "dgram_ctrl"
        }
    }
]
vanir_signatures_modified 
"2026-11-12T07:07:33Z"