The vulnerability arises in the OpenSSL QUIC server Listener SSL object when it processes valid QUIC Initial packets for unknown destination connection IDs. If no existing connection matches the Connection-Id, the server allocates a new channel object and queues it for acceptance by the application via SSL_accept(). Without any limit on pending connections, an attacker can cause the server to allocate memory indefinitely by sending many Initial packets faster than the application accepts them. This resource exhaustion leads to denial of service. The flaw is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The fix introduces a default limit of 256 pending connections, adjustable via SSL_set_value_uint(). The vulnerability affects OpenSSL versions starting from 3.5 when QUIC was added. The FIPS module is not affected as QUIC is outside its boundary.

A remote attacker can cause the OpenSSL QUIC server to allocate memory without bounds by sending a high volume of valid QUIC Initial packets with unknown destination connection IDs. This can exhaust server memory resources, making the QUIC listener unavailable and resulting in a denial of service condition. There is no indication of code execution or data compromise from the provided information.

A fix has been implemented that enforces a limit on the number of pending QUIC connections waiting to be accepted, with a default limit of 256. Applications can adjust this limit using SSL_set_value_uint(). Users should upgrade to a version of OpenSSL that includes this fix. Since no specific patched version is stated, check the official OpenSSL advisories for the fixed release. Until patched, applications should ensure they accept connections promptly to avoid resource exhaustion.