UBUNTU-CVE-2026-35191

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-35191
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35191.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-35191
Upstream
Downstream
Related
Published
2026-09-29T00:00:00Z
Modified
2026-10-17T12:58:12Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
  • Ubuntu - low
Summary
[none]
Details

Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC 9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3 times the amount of data received from the peer address, until such time as the TLS handshake is completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A remote peer may, after establishing a connection with an initial client hello frame, send a subsequent datagram containing multiple QUIC packets, leading the server to account the entire datagram length for each packet in the datagram, resulting in the server believing that the peer has sent more data than it actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.

References

Affected packages

Ubuntu:26.04:LTS
edk2

Package

Name
edk2
Purl
pkg:deb/ubuntu/edk2?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2025.*
2025.02-8ubuntu3
2025.11-3ubuntu6
2025.11-3ubuntu7
2025.11-3ubuntu7.2
2025.11-3ubuntu7.3

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "efi-shell-aa64",
            "binary_version":  "2025.11-3ubuntu7.3"
        },
        {
            "binary_name":  "efi-shell-loongarch64",
            "binary_version":  "2025.11-3ubuntu7.3"
        },
        {
            "binary_name":  "efi-shell-riscv64",
            "binary_version":  "2025.11-3ubuntu7.3"
        },
        {
            "binary_name":  "efi-shell-x64",
            "binary_version":  "2025.11-3ubuntu7.3"
        },
        {
            "binary_name":  "ovmf",
            "binary_version":  "2025.11-3ubuntu7.3"
        },
        {
            "binary_name":  "ovmf-amdsev",
            "binary_version":  "2025.11-3ubuntu7.3"
        },
        {
            "binary_name":  "ovmf-generic",
            "binary_version":  "2025.11-3ubuntu7.3"
        },
        {
            "binary_name":  "ovmf-inteltdx",
            "binary_version":  "2025.11-3ubuntu7.3"
        },
        {
            "binary_name":  "ovmf-legacy",
            "binary_version":  "2025.11-3ubuntu7.3"
        },
        {
            "binary_name":  "qemu-efi-aarch64",
            "binary_version":  "2025.11-3ubuntu7.3"
        },
        {
            "binary_name":  "qemu-efi-loongarch64",
            "binary_version":  "2025.11-3ubuntu7.3"
        },
        {
            "binary_name":  "qemu-efi-riscv64",
            "binary_version":  "2025.11-3ubuntu7.3"
        }
    ],
    "priority_reason":  "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35191.json"
edk2-hwe

Package

Name
edk2-hwe
Purl
pkg:deb/ubuntu/edk2-hwe?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2025.*
2025.11-3ubuntu6
2025.11-3ubuntu8
2025.11-3ubuntu8.2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "efi-shell-aa64-hwe",
            "binary_version":  "2025.11-3ubuntu8.2"
        },
        {
            "binary_name":  "efi-shell-loongarch64-hwe",
            "binary_version":  "2025.11-3ubuntu8.2"
        },
        {
            "binary_name":  "efi-shell-riscv64-hwe",
            "binary_version":  "2025.11-3ubuntu8.2"
        },
        {
            "binary_name":  "efi-shell-x64-hwe",
            "binary_version":  "2025.11-3ubuntu8.2"
        },
        {
            "binary_name":  "ovmf-amdsev-hwe",
            "binary_version":  "2025.11-3ubuntu8.2"
        },
        {
            "binary_name":  "ovmf-generic-hwe",
            "binary_version":  "2025.11-3ubuntu8.2"
        },
        {
            "binary_name":  "ovmf-hwe",
            "binary_version":  "2025.11-3ubuntu8.2"
        },
        {
            "binary_name":  "ovmf-inteltdx-hwe",
            "binary_version":  "2025.11-3ubuntu8.2"
        },
        {
            "binary_name":  "ovmf-legacy-hwe",
            "binary_version":  "2025.11-3ubuntu8.2"
        },
        {
            "binary_name":  "qemu-efi-aarch64-hwe",
            "binary_version":  "2025.11-3ubuntu8.2"
        },
        {
            "binary_name":  "qemu-efi-loongarch64-hwe",
            "binary_version":  "2025.11-3ubuntu8.2"
        },
        {
            "binary_name":  "qemu-efi-riscv64-hwe",
            "binary_version":  "2025.11-3ubuntu8.2"
        }
    ],
    "priority_reason":  "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35191.json"
openssl

Package

Name
openssl
Purl
pkg:deb/ubuntu/openssl?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.5.5-1ubuntu3.6

Affected versions

3.*
3.5.3-1ubuntu2
3.5.5-1ubuntu1
3.5.5-1ubuntu3
3.5.5-1ubuntu3.2
3.5.5-1ubuntu3.3
3.5.5-1ubuntu3.4
3.5.5-1ubuntu3.5

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "libssl3t64",
            "binary_version":  "3.5.5-1ubuntu3.6"
        },
        {
            "binary_name":  "openssl",
            "binary_version":  "3.5.5-1ubuntu3.6"
        },
        {
            "binary_name":  "openssl-provider-legacy",
            "binary_version":  "3.5.5-1ubuntu3.6"
        }
    ],
    "priority_reason":  "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35191.json"
Ubuntu:26.10
edk2

Package

Name
edk2
Purl
pkg:deb/ubuntu/edk2?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2025.*
2025.11-3ubuntu7
2025.11-3ubuntu8
2026.*
2026.05-2ubuntu1
2026.05-2ubuntu2
2026.05-2ubuntu3

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "efi-shell-aa64",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "efi-shell-loongarch64",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "efi-shell-riscv64",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "efi-shell-x64",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "ovmf",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "ovmf-amdsev",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "ovmf-generic",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "ovmf-inteltdx",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "ovmf-legacy",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "qemu-efi-aarch64",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "qemu-efi-loongarch64",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "qemu-efi-riscv64",
            "binary_version":  "2026.05-2ubuntu3"
        }
    ],
    "priority_reason":  "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35191.json"
edk2-hwe

Package

Name
edk2-hwe
Purl
pkg:deb/ubuntu/edk2-hwe?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2025.*
2025.11-3ubuntu8
2025.11-3ubuntu9
2026.*
2026.05-2ubuntu1
2026.05-2ubuntu2
2026.05-2ubuntu3

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "efi-shell-aa64-hwe",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "efi-shell-loongarch64-hwe",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "efi-shell-riscv64-hwe",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "efi-shell-x64-hwe",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "ovmf-amdsev-hwe",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "ovmf-generic-hwe",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "ovmf-hwe",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "ovmf-inteltdx-hwe",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "ovmf-legacy-hwe",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "qemu-efi-aarch64-hwe",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "qemu-efi-loongarch64-hwe",
            "binary_version":  "2026.05-2ubuntu3"
        },
        {
            "binary_name":  "qemu-efi-riscv64-hwe",
            "binary_version":  "2026.05-2ubuntu3"
        }
    ],
    "priority_reason":  "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35191.json"
Ubuntu:Pro:22.04:LTS
nodejs

Package

Name
nodejs
Purl
pkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

12.*
12.22.5~dfsg-5ubuntu1
12.22.7~dfsg-2ubuntu1
12.22.7~dfsg-2ubuntu3
12.22.9~dfsg-1ubuntu2
12.22.9~dfsg-1ubuntu3
12.22.9~dfsg-1ubuntu3.1
12.22.9~dfsg-1ubuntu3.2
12.22.9~dfsg-1ubuntu3.3
12.22.9~dfsg-1ubuntu3.4
12.22.9~dfsg-1ubuntu3.5
12.22.9~dfsg-1ubuntu3.6
12.22.9~dfsg-1ubuntu3.6+esm2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libnode72",
            "binary_version":  "12.22.9~dfsg-1ubuntu3.6+esm2"
        },
        {
            "binary_name":  "nodejs",
            "binary_version":  "12.22.9~dfsg-1ubuntu3.6+esm2"
        }
    ],
    "priority_reason":  "OpenSSL developers have rated this issue as being low severity"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-35191.json"