UpHeron
All vulnerabilities

Servers and applications

CVE-2026-18798

Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly…

Severity
High 7.5
Published
25 Aug 2026
Last changed
23 Sept 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.5.8, 3.6.4, 4.0.2
Sources
NVD

Affected software

SoftwareAffected versions
OpenSSLServers and applications · cpe:a:openssl:openssl
  • From 3.5.0 before 3.5.8
  • From 3.6.0 before 3.6.4
  • From 4.0.0 before 4.0.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-18798
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-18798