The QUIC process retains memory for packet buffers longer than needed because it defers copying stream data to application buffers, holding references to packet buffers until copying completes. This behavior enables a remote attacker to send maliciously crafted packets that cause the QUIC stack to allocate and hold excessive memory, with the duration of allocation controlled by the attacker. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The mitigation involves calculating and monitoring memory overhead per stream and moving stream frame data from packet buffers to stream buffers once cumulative overhead exceeds 64kB, limiting memory retention.

A remote peer can exploit this vulnerability by sending crafted packets that cause the local QUIC stack to allocate and retain excessive memory for packet buffers. This can lead to increased memory usage on the affected system, potentially impacting performance or stability. The attacker controls how long the memory remains allocated. There is no indication of direct code execution or data corruption. The OpenSSL FIPS module is not affected.

The vulnerability is mitigated by the QUIC stack's updated behavior that calculates and monitors memory overhead per stream. When the overhead exceeds 64kB, the stack moves stream frame data from packet buffers to stream buffers, reducing memory retention time. No additional action is required from users if they are running the updated QUIC stack with this mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.