CVE-2026-14456 is a denial of service vulnerability in OpenSSL's QUIC server implementation present in version 3.5.x. An attacker can send a large number of QUIC Initial packets to the server, causing it to allocate and queue new incoming channels without limit, resulting in unbounded memory consumption. This leads to a denial of service condition by making the QUIC listener unavailable. The vulnerability affects Red Hat Hardened Images shipping OpenSSL 3.5.x, specifically versions prior to 3.6.0. Systems running earlier OpenSSL versions without QUIC support are not affected. The vulnerability requires the QUIC server listener to be explicitly enabled to be exploitable. Red Hat has issued a security advisory and released patched RPMs including openssl-3.5.6-0.5.hum1 to fix this issue.

The vulnerability allows remote attackers to cause unbounded memory growth on affected OpenSSL QUIC servers, leading to denial of service by exhausting server memory and making the QUIC listener unavailable. There is no impact on confidentiality or integrity. The flaw requires the QUIC server listener to be enabled and affects network-exposed services listening on UDP port 443. Systems not running the QUIC server or not listening on UDP 443 are not affected.

Red Hat has released fixed OpenSSL packages (openssl-3.5.6-0.5.hum1) that address this vulnerability and should be applied promptly. Until patched, administrators should verify if any service is listening on UDP port 443 for QUIC traffic. If so, rate-limit or firewall inbound UDP 443 traffic to slow or block QUIC Initial packets. If QUIC/HTTP3 is not required, disable the QUIC server listener entirely to eliminate exposure. Application owners can also adjust the SSL_VALUE_QUIC_MAX_PENDING_CONNS parameter if the default limit is too high. Following these steps will mitigate the risk until the update is applied.