OpenSSL's QUIC stack enforces stream-level flow control limits but fails to enforce connection-level flow control limits for streams. This flaw allows a remote peer to open multiple streams, each within the stream-level flow control limit, and send data without zero-offset bytes, causing the local stack to allocate excessive memory. Specifically, the stack may allocate approximately 2 times MAX_STREAMS (default 100) times the stream flow control limit (default 512 KiB), resulting in about 100MB of heap allocation per connection. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The FIPS module is unaffected since the QUIC implementation is outside its scope.

A malicious remote peer can exploit this vulnerability to cause the OpenSSL QUIC stack to allocate excessive memory (up to ~100MB) per connection, significantly more than the default 768 KiB flow control window. This can lead to resource exhaustion on the affected system, potentially impacting availability. There is no confidentiality or integrity impact reported. The vulnerability does not affect the OpenSSL FIPS module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for unusual memory usage related to QUIC connections and consider limiting the number of concurrent QUIC streams or connections if possible. No official patch or workaround is currently documented.