{"schema_version":"1","data":[{"id":4913,"advisory_id":"ffb7e68b-c6cb-47b8-b641-0afb484eaf4c","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42772","source_published_at":"2026-09-29T15:32:14.009+00:00","published_at":"2026-10-24T21:59:30.117612+00:00","extraction_method":"structured","technologies":["core-cve","openssl"],"cve_ids":["CVE-2026-42772"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC","summary":"Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407: Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations, consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.","evidence":"cve:CVE-2026-42772","products":[{"name":{"value":"OpenSSL","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-42772","aliases":["CVE-2026-42772"],"metrics":[{"other":{"type":"https://openssl-library.org/policies/general/security-policy/","content":{"text":"Low"}},"format":"other"}],"affected":[{"vendor":"OpenSSL","product":"OpenSSL","versions":[{"status":"affected","version":"4.0.0","lessThan":"4.0.3","versionType":"semver"},{"status":"affected","version":"3.6.0","lessThan":"3.6.5","versionType":"semver"},{"status":"affected","version":"3.5.0","lessThan":"3.5.9","versionType":"semver"},{"status":"affected","version":"3.4.0","lessThan":"3.4.8","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T20:11:09.295Z","provider":"cve","references":["https://openssl-library.org/news/secadv/20260929.txt","https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a","https://github.com/openssl/openssl/commit/32d0ed8afe1b8c3e7ece725b44663da3d7087a09","https://github.com/openssl/openssl/commit/ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e","https://github.com/openssl/openssl/commit/eb2becc0a4baea7f3050a247834d0e5c2ebe1773"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-42772","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T19:35:54.157005Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T20:11:09.295Z"}}],"cna":{"orgId":"3a12439a-ef3a-4c79-92e6-6081a721f1e5","shortName":"openssl","dateUpdated":"2026-09-29T15:32:14.009Z"}}},"related_cves":[{"value":"CVE-2026-42772","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":4913,"next_before":4913}