CVE-2026-95691

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-95691
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95691.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-95691
Downstream
Published
2026-11-10T18:16:03Z
Modified
2026-11-12T07:07:30Z
Summary
Retransmitted QUIC CRYPTO Frames Can Cause DoS or One-byte Disclosure
Details

Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage while the TLS record layer retains a direct pointer into that storage causing use after free.

Impact summary: A malicious QUIC server can cause a heap-use-after-free read in the OpenSSL QUIC client. The server can also identify one allocator-adjacent byte through the client's protected Handshake response.

CWE: CWE-416: Use After Free

Description: During CRYPTO stream processing, a pointer into the first frame's memory on the stream is lent to the TLS handshake processing. The memory must remain stable until it is processed and released. However the processing of retransmitted CRYPTO frames could release the memory if the retransmitted frame fully overlapped the existing frame. This then causes use-after-free read when the TLS handshake processing continues.

The use-after-free read can lead to a Denial-of-Service of the client application or a minor leak of information about the heap memory contents that might be overwritten with other data, subsequently allocated by the application, to the peer.

FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.

Database specific 
{
    "cna_assigner": "openssl",
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95691.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "4.1.0"
                        },
                        {
                            "fixed": "4.1.1"
                        },
                        {
                            "introduced": "4.0.0"
                        },
                        {
                            "fixed": "4.0.4"
                        },
                        {
                            "introduced": "3.5.0"
                        },
                        {
                            "fixed": "3.5.10"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/openssl/openssl

Affected ranges

Type
GIT
Repo
https://github.com/openssl/openssl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1
Fixed
ec9d4de9d03989b29db5a3d7efdb4c285deaf386
Fixed
f6244675833e097c2429a40d1b206d95385bd42f
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "ec9d4de9d03989b29db5a3d7efdb4c285deaf386"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "f6244675833e097c2429a40d1b206d95385bd42f"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*
3.5-POST-CLANG-FORMAT-WEBKIT
3.5-PRE-CLANG-FORMAT-WEBKIT
4.*
4.0-POST-CLANG-FORMAT-WEBKIT
4.0-PRE-CLANG-FORMAT-WEBKIT
Other
BEFORE_engine
OpenSSL_0_9_1c
OpenSSL_0_9_2b
OpenSSL_0_9_3
OpenSSL_0_9_3a
OpenSSL_0_9_3beta2
OpenSSL_0_9_4
OpenSSL_0_9_5a
OpenSSL_0_9_5a-beta1
OpenSSL_0_9_5a-beta2
OpenSSL_0_9_5beta1
OpenSSL_0_9_5beta2
OpenSSL_0_9_6-beta3
OpenSSL_1_1_0-pre1
OpenSSL_1_1_0-pre2
OpenSSL_1_1_0-pre3
OpenSSL_1_1_0-pre4
OpenSSL_1_1_0-pre5
OpenSSL_1_1_0-pre6
OpenSSL_1_1_1
OpenSSL_1_1_1-pre1
OpenSSL_1_1_1-pre2
OpenSSL_1_1_1-pre3
OpenSSL_1_1_1-pre4
OpenSSL_1_1_1-pre5
OpenSSL_1_1_1-pre6
OpenSSL_1_1_1-pre7
OpenSSL_1_1_1-pre8
OpenSSL_1_1_1-pre9
master-post-auto-reformat
master-post-reformat
master-pre-auto-reformat
master-pre-reformat
openssl-3.*
openssl-3.0.0-alpha1
openssl-3.0.0-alpha10
openssl-3.0.0-alpha11
openssl-3.0.0-alpha12
openssl-3.0.0-alpha13
openssl-3.0.0-alpha14
openssl-3.0.0-alpha15
openssl-3.0.0-alpha16
openssl-3.0.0-alpha17
openssl-3.0.0-alpha2
openssl-3.0.0-alpha3
openssl-3.0.0-alpha4
openssl-3.0.0-alpha5
openssl-3.0.0-alpha6
openssl-3.0.0-alpha7
openssl-3.0.0-alpha8
openssl-3.0.0-alpha9
openssl-3.0.0-beta1
openssl-3.0.0-beta2
openssl-3.2.0-alpha1
openssl-3.2.0-alpha2
openssl-3.4.0-alpha1
openssl-3.5.0
openssl-3.5.0-alpha1
openssl-3.5.0-beta1
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
openssl-3.5.4
openssl-3.5.5
openssl-3.5.6
openssl-3.5.7
openssl-3.5.8
openssl-3.5.9
openssl-4.*
openssl-4.0.0
openssl-4.0.0-alpha1
openssl-4.0.0-beta1
openssl-4.0.1
openssl-4.0.2
openssl-4.0.3
openssl-4.1.0
openssl-4.1.0-alpha1
openssl-4.1.0-beta1
openssl-4.1.0-beta2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95691.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "281507628111372938163312117563257714678",
            "length": 757
        },
        "id": "CVE-2026-95691-129aca90",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1",
        "target": {
            "file": "ssl/quic/quic_rstream.c",
            "function": "ossl_quic_rstream_get_record"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "337532848169811819713507322500901457220",
                "117488088680632526077899275660332083928",
                "27171778086867925355800559220157539105",
                "242725576314168574099947238718193354924",
                "177826699598872197593703018898603686655",
                "273409241663500460045924244658629066280",
                "297284193697515460374622151074135378204",
                "193623468992794951564579422198782131437",
                "266283937327745078817706343838672017566",
                "163516744740676298834772360829058721941",
                "194755881191102225311239841229646867328",
                "30808342220207066251725370388775602088",
                "28327948172053847838095315253749975256"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95691-243a0241",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f",
        "target": {
            "file": "ssl/quic/quic_rstream.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "91806962366979551246019119216089320014",
                "242043148712723642778986156913917419323",
                "253071197177219502882630316480210293599",
                "120157287676772691932870815208315530167",
                "126715514809307429457427388160427391604",
                "112788039189498109025639636190620132478",
                "68724584330058937133586208365655544953",
                "288850338176712272769664293631858883363",
                "211090977260866709392261254588059554978"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95691-3a8e0b33",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386",
        "target": {
            "file": "ssl/quic/quic_strm_reas.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "297460851814775457019057221731361851465",
            "length": 1514
        },
        "id": "CVE-2026-95691-3e265782",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f",
        "target": {
            "file": "ssl/quic/quic_strm_reas.c",
            "function": "ossl_sframe_set_move_offset"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "177595594322692520037454304827186660380",
            "length": 449
        },
        "id": "CVE-2026-95691-3ef94cc0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f",
        "target": {
            "file": "ssl/quic/quic_rstream.c",
            "function": "ossl_quic_rstream_release_record"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "308762008190389962222966418438606317501",
            "length": 314
        },
        "id": "CVE-2026-95691-403b1eaf",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1",
        "target": {
            "file": "ssl/quic/quic_rstream.c",
            "function": "ossl_quic_rstream_read"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "177595594322692520037454304827186660380",
            "length": 449
        },
        "id": "CVE-2026-95691-46265c1f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1",
        "target": {
            "file": "ssl/quic/quic_rstream.c",
            "function": "ossl_quic_rstream_release_record"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "297460851814775457019057221731361851465",
            "length": 1514
        },
        "id": "CVE-2026-95691-5181dd1b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1",
        "target": {
            "file": "ssl/quic/quic_strm_reas.c",
            "function": "ossl_sframe_set_move_offset"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "177595594322692520037454304827186660380",
            "length": 449
        },
        "id": "CVE-2026-95691-5546cc7f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386",
        "target": {
            "file": "ssl/quic/quic_rstream.c",
            "function": "ossl_quic_rstream_release_record"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "70773058772123886737255428292211462973",
                "140093985579909921150448261810695196793",
                "255710743085613727868179767442791962190",
                "295196883450884570308397310150792033499",
                "37382954290418743792969372450028702663",
                "137302240832677319531801253265877000631",
                "105820644018548011718340953637707551984"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95691-55f6295b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f",
        "target": {
            "file": "include/internal/quic_strm_reas.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "70773058772123886737255428292211462973",
                "140093985579909921150448261810695196793",
                "255710743085613727868179767442791962190",
                "295196883450884570308397310150792033499",
                "37382954290418743792969372450028702663",
                "137302240832677319531801253265877000631",
                "105820644018548011718340953637707551984"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95691-5f6b5409",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1",
        "target": {
            "file": "include/internal/quic_strm_reas.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "91806962366979551246019119216089320014",
                "242043148712723642778986156913917419323",
                "253071197177219502882630316480210293599",
                "120157287676772691932870815208315530167",
                "126715514809307429457427388160427391604",
                "112788039189498109025639636190620132478",
                "68724584330058937133586208365655544953",
                "288850338176712272769664293631858883363",
                "211090977260866709392261254588059554978"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95691-650b0a4a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f",
        "target": {
            "file": "ssl/quic/quic_strm_reas.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "244719788554341712572317084789261552751",
            "length": 5321
        },
        "id": "CVE-2026-95691-83bbaebe",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386",
        "target": {
            "file": "ssl/quic/quic_strm_reas.c",
            "function": "ossl_sframe_set_insert"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "70773058772123886737255428292211462973",
                "140093985579909921150448261810695196793",
                "255710743085613727868179767442791962190",
                "295196883450884570308397310150792033499",
                "37382954290418743792969372450028702663",
                "137302240832677319531801253265877000631",
                "105820644018548011718340953637707551984"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95691-8f004145",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386",
        "target": {
            "file": "include/internal/quic_strm_reas.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "308762008190389962222966418438606317501",
            "length": 314
        },
        "id": "CVE-2026-95691-953c8574",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f",
        "target": {
            "file": "ssl/quic/quic_rstream.c",
            "function": "ossl_quic_rstream_read"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "337532848169811819713507322500901457220",
                "117488088680632526077899275660332083928",
                "27171778086867925355800559220157539105",
                "242725576314168574099947238718193354924",
                "177826699598872197593703018898603686655",
                "273409241663500460045924244658629066280",
                "297284193697515460374622151074135378204",
                "193623468992794951564579422198782131437",
                "266283937327745078817706343838672017566",
                "163516744740676298834772360829058721941",
                "194755881191102225311239841229646867328",
                "30808342220207066251725370388775602088",
                "28327948172053847838095315253749975256"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95691-9cfd06ba",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1",
        "target": {
            "file": "ssl/quic/quic_rstream.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "281507628111372938163312117563257714678",
            "length": 757
        },
        "id": "CVE-2026-95691-b2303e8e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f",
        "target": {
            "file": "ssl/quic/quic_rstream.c",
            "function": "ossl_quic_rstream_get_record"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "91806962366979551246019119216089320014",
                "242043148712723642778986156913917419323",
                "253071197177219502882630316480210293599",
                "120157287676772691932870815208315530167",
                "126715514809307429457427388160427391604",
                "112788039189498109025639636190620132478",
                "68724584330058937133586208365655544953",
                "288850338176712272769664293631858883363",
                "211090977260866709392261254588059554978"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95691-cf88dc24",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1",
        "target": {
            "file": "ssl/quic/quic_strm_reas.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "244719788554341712572317084789261552751",
            "length": 5321
        },
        "id": "CVE-2026-95691-d36034a8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1",
        "target": {
            "file": "ssl/quic/quic_strm_reas.c",
            "function": "ossl_sframe_set_insert"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "308762008190389962222966418438606317501",
            "length": 314
        },
        "id": "CVE-2026-95691-df42c5fb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386",
        "target": {
            "file": "ssl/quic/quic_rstream.c",
            "function": "ossl_quic_rstream_read"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "281507628111372938163312117563257714678",
            "length": 757
        },
        "id": "CVE-2026-95691-e384a1aa",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386",
        "target": {
            "file": "ssl/quic/quic_rstream.c",
            "function": "ossl_quic_rstream_get_record"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "337532848169811819713507322500901457220",
                "117488088680632526077899275660332083928",
                "27171778086867925355800559220157539105",
                "242725576314168574099947238718193354924",
                "177826699598872197593703018898603686655",
                "273409241663500460045924244658629066280",
                "297284193697515460374622151074135378204",
                "193623468992794951564579422198782131437",
                "266283937327745078817706343838672017566",
                "163516744740676298834772360829058721941",
                "194755881191102225311239841229646867328",
                "30808342220207066251725370388775602088",
                "28327948172053847838095315253749975256"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95691-e503e996",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386",
        "target": {
            "file": "ssl/quic/quic_rstream.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "297460851814775457019057221731361851465",
            "length": 1514
        },
        "id": "CVE-2026-95691-e9463edd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386",
        "target": {
            "file": "ssl/quic/quic_strm_reas.c",
            "function": "ossl_sframe_set_move_offset"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "244719788554341712572317084789261552751",
            "length": 5321
        },
        "id": "CVE-2026-95691-eba0aae3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f",
        "target": {
            "file": "ssl/quic/quic_strm_reas.c",
            "function": "ossl_sframe_set_insert"
        }
    }
]
vanir_signatures_modified 
"2026-11-12T07:07:30Z"