Issue summary: QUIC server may double free QRX

CVE-2026-18798 is a double-free (CWE-415) in OpenSSL's QUIC server record-layer receive path (port_default_packet_handler()). When a QUIC INITIAL packet arrives and channel creation subsequently fails, the QRX object is freed once by port_bind_channel() and again by the error-handling cleanup code, corrupting the heap and crashing the process. Affected versions are OpenSSL 4.0.0–4.0.1, 3.6.0–3.6.3, and 3.5.0–3.5.7. Fixed in 4.0.2, 3.6.4, and 3.5.8. Only the server-side QUIC code path is reachable — TLS, DTLS, and QUIC client usage are completely unaffected.

The vendor CVSS of 7.5 / HIGH reflects the unauthenticated, network-reachable, no-interaction DoS vector — and that math is correct *in the abstract*. But OpenSSL's own severity classification is Moderate, and that's closer to reality. QUIC server support landed only in OpenSSL 3.5 (March 2025) and adoption is still early. The vast majority of OpenSSL deployments — web servers, VPN appliances, mail relays, API gateways — use TLS, not native OpenSSL QUIC. The impact ceiling is process crash (DoS), not code execution. For a 10,000-host fleet, the number of hosts actually running an OpenSSL-native QUIC *server* endpoint is likely in the single digits, if any.

Why this verdict

• Narrow attack surface: Only OpenSSL's QUIC *server* code path is affected. TLS, DTLS, and QUIC client are untouched. The QUIC server feature shipped in OpenSSL 3.5 (March 2025) and is not yet widely deployed in enterprise stacks.
• DoS-only blast radius: The double-free crashes the process. OpenSSL explicitly states no evidence of RCE exploitability. Impact is availability loss, not compromise. CVSS confirms C:N/I:N.
• Auto-restart resilience: Production services behind systemd, Kubernetes, or container orchestrators restart within seconds. Sustained DoS requires continuous attack traffic, which is noisy and rate-limitable.
• Role multiplier: OpenSSL is canonically a high-value component (it runs on network edge appliances, web servers, identity infrastructure). However, the *QUIC server* feature is a small subset of OpenSSL's functionality. High-value roles like F5, Citrix NetScaler, HAProxy, and nginx typically use their own QUIC stacks or BoringSSL, not OpenSSL-native QUIC. Domain controllers, hypervisors, CAs, backup servers, and EDR agents do not run QUIC servers. The fraction of high-value-role installs reachable via this bug is well under 1%, which breaks the HIGH floor requirement.
• No exploitation signals: No KEV listing, no PoC, no in-the-wild activity. Disclosed <48 hours ago with patches already available.

Why not higher?

To justify HIGH, this bug would need either RCE potential or significant deployment in high-value roles. It has neither. The double-free is DoS-only per OpenSSL's own analysis, and the QUIC server feature is too new and too niche to claim meaningful enterprise exposure. OpenSSL's own severity team rated it Moderate, not High.

Why not lower?

Despite the narrow exposure, this *is* unauthenticated and remotely triggerable with no user interaction from a single UDP packet. Any host that *does* run an OpenSSL-native QUIC server is trivially crashable. The affected component (OpenSSL) is foundational infrastructure, so even niche features warrant tracking. LOW would understate the risk for the small population of affected deployments.

1. Audit for OpenSSL QUIC server listeners — Run lsof -i UDP | grep -E ':(443|8443)' and cross-reference with openssl version on each host to identify any process actually using OpenSSL ≥3.5 QUIC server mode. If you find zero (likely), document it and deprioritize. No mitigation SLA applies for MEDIUM — go straight to the 365-day remediation window.
2. Rate-limit inbound QUIC INITIAL packets — If you do run affected QUIC servers, configure your perimeter firewall or load balancer to rate-limit UDP/443 INITIAL packets per source IP (e.g., 10/sec). This blunts sustained crash-loop DoS without breaking legitimate QUIC handshakes.
3. Ensure process supervisors auto-restart QUIC services — Verify that any QUIC-serving process is managed by systemd (with Restart=always), Kubernetes liveness probes, or equivalent. This limits each crash to a sub-second blip rather than sustained outage.
4. Update OpenSSL to patched version — Upgrade to OpenSSL 4.0.2, 3.6.4, or 3.5.8 within the noisgate remediation SLA of 365 days. If your distro hasn't released the update yet, track the package and apply when available.

Run this script on each host suspected of running an OpenSSL QUIC server. It checks the installed OpenSSL library version. Execute as any user: bash check_cve_2026_18798.sh

#!/usr/bin/env bash
# CVE-2026-18798 checker — OpenSSL QUIC server double-free
# Run on target hosts. No special privileges required.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

OSSL=$(openssl version 2>/dev/null || true)
if [ -z "$OSSL" ]; then
  echo "UNKNOWN — openssl binary not found in PATH"
  exit 2
fi

# Extract version number
VER=$(echo "$OSSL" | grep -oP '\d+\.\d+\.\d+' | head -1)
if [ -z "$VER" ]; then
  echo "UNKNOWN — could not parse version from: $OSSL"
  exit 2
fi

MAJOR=$(echo "$VER" | cut -d. -f1)
MINOR=$(echo "$VER" | cut -d. -f2)
PATCH=$(echo "$VER" | cut -d. -f3)

# Branches without QUIC server support are not affected
# (1.x, 3.0.x, 3.1.x, 3.2.x, 3.3.x, 3.4.x)
if [ "$MAJOR" -lt 3 ]; then
  echo "PATCHED — $OSSL (no QUIC server support, not affected)"
  exit 0
fi
if [ "$MAJOR" -eq 3 ] && [ "$MINOR" -lt 5 ]; then
  echo "PATCHED — $OSSL (no QUIC server support, not affected)"
  exit 0
fi

# Check affected ranges
# 3.5.0-3.5.7 vulnerable, 3.5.8+ patched
if [ "$MAJOR" -eq 3 ] && [ "$MINOR" -eq 5 ]; then
  if [ "$PATCH" -lt 8 ]; then
    echo "VULNERABLE — $OSSL (fixed in 3.5.8)"
    exit 1
  else
    echo "PATCHED — $OSSL"
    exit 0
  fi
fi

# 3.6.0-3.6.3 vulnerable, 3.6.4+ patched
if [ "$MAJOR" -eq 3 ] && [ "$MINOR" -eq 6 ]; then
  if [ "$PATCH" -lt 4 ]; then
    echo "VULNERABLE — $OSSL (fixed in 3.6.4)"
    exit 1
  else
    echo "PATCHED — $OSSL"
    exit 0
  fi
fi

# 4.0.0-4.0.1 vulnerable, 4.0.2+ patched
if [ "$MAJOR" -eq 4 ] && [ "$MINOR" -eq 0 ]; then
  if [ "$PATCH" -lt 2 ]; then
    echo "VULNERABLE — $OSSL (fixed in 4.0.2)"
    exit 1
  else
    echo "PATCHED — $OSSL"
    exit 0
  fi
fi

# Future versions assumed patched
echo "PATCHED — $OSSL (version newer than known affected range)"
exit 0

Sources

1. OpenSSL Vulnerabilities Page
2. OpenSSL Security Advisory — August 2026
3. OpenSSL 4.0.2 Patches 11 Vulnerabilities
4. OpenSSL 4.0.2 Release Notes — 9to5Linux
5. OpenSSL QUIC Server Feature Announcement (3.5)
6. HTTP/3 and QUIC Protocol Adoption 2026
7. OpenSSL Vulnerabilities — 3.5 Branch