PatchTheCVECVE-2026-75804: Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams
CVE-2026-75804 is a medium-severity flaw (CVSS 5.3) affecting openssl. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size). CWE: CWE-770: Allocation of Resources Without Limits or Thr
Why this priority
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 55%) |
| CISA exploited list | No |
| Weakness | CWE-770 |
| Published | 2026-09-29 |
| Last modified | 2026-10-08 |
Last updated 2026-10-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-75804?
openssl: upgrade to 3.4.8, 3.5.9, 3.6.5, 4.0.3. Exact commands for each OS are on this page.
Is CVE-2026-75804 being exploited?
CVE-2026-75804 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-75804 affect?
CVE-2026-75804 affects openssl. Severity is medium (CVSS 5.3). Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit t
How urgent is CVE-2026-75804?
Priority 40/100. Remotely exploitable, no login, no user action; On your watchlist
Software pages
Related CVEs
- CVE-2026-84784 HIGH 7.5 UPGRADE Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoidin
- CVE-2026-84783 HIGH 7.5 UPGRADE Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached
- CVE-2026-84782 HIGH 8.2 UPGRADE Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspe
- CVE-2026-77696 LOW 3.7 UPGRADE Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing s
- CVE-2026-75806 MEDIUM 5.3 UPGRADE Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single un