CVE-2026-84784 describes a resource exhaustion vulnerability in the OpenSSL QUIC stack where a remote peer can send excessive NEW_CONNECTION_ID frames, causing the local stack to allocate large amounts of memory. The local stack sends a RETIRE_CONNECTION_ID frame for each NEW_CONNECTION_ID received, but due to flawed logic, it retires connection IDs immediately upon receiving NEW_CONNECTION_ID frames rather than waiting for acknowledgment of RETIRE_CONNECTION_ID frames as mandated by RFC 9000 sections 5.1.1 and 5.1.2. This leads to a backlog growth in the Control Frame Queue and resource exhaustion. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The OpenSSL QUIC stack supports only one destination CID per connection but can be tricked into processing multiple RETIRE_CONNECTION_ID frames, exacerbating the issue. The FIPS module is not affected as the QUIC implementation lies outside its boundary.

The vulnerability can cause a denial of service condition by forcing the local QUIC stack to allocate approximately 400MB of memory, potentially exhausting system resources. This occurs when a malicious remote peer floods the local stack with NEW_CONNECTION_ID frames and withholds acknowledgments, leading to uncontrolled resource consumption. There is no impact on confidentiality or integrity, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue arises from incorrect handling of connection ID retirement logic; correcting this logic to retire connection IDs only after receiving acknowledgments for RETIRE_CONNECTION_ID frames will fix the backlog growth and resource exhaustion. Until a fix is available, monitoring for unusual QUIC connection ID frame patterns and limiting resource allocation may help mitigate impact.