{"metadata": {"vulnerability": "CVE-2026-88822", "count": 19, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 12}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-10T09:08:26.966Z", "date_only": false, "value": "2026-09-10T09:08:26.966Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-88822", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "vulnerabilities.1.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1496", "record": "CERTFR-2026-AVI-1496", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": true, "value": "2026-11-10", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1496", "record": "CERTFR-2026-AVI-1496", "field": "initial_release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": false, "value": "2026-11-10T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1496", "record": "CERTFR-2026-AVI-1496", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-11-10T11:00:00Z", "date_only": false, "value": "2026-11-10T11:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / openssl", "record": "CVE-2026-88822", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T13:12:32.287Z", "date_only": false, "value": "2026-11-10T13:12:32.287+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-10T18:15:38.961Z", "date_only": false, "value": "2026-11-10T18:15:38.961Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-88822", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T18:15:38.961Z", "date_only": false, "value": "2026-11-10T18:15:38.961Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-88822", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-10T18:15:38.961Z", "date_only": false, "value": "2026-11-10T18:15:38.961Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / openssl", "record": "CVE-2026-88822", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-10T19:21:34Z", "date_only": false, "value": "2026-11-10T19:21:34Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-M2VH-6QF5-47P9", "record": "GHSA-M2VH-6QF5-47P9", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-10T19:21:34.623Z", "date_only": false, "value": "2026-11-10T19:21:34.623", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88822", "record": "FKIE_CVE-2026-88822", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T21:34:01Z", "date_only": false, "value": "2026-11-10T21:34:01Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-M2VH-6QF5-47P9", "record": "GHSA-M2VH-6QF5-47P9", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T21:34:01Z", "date_only": false, "value": "2026-11-10T21:34:01Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-M2VH-6QF5-47P9", "record": "GHSA-M2VH-6QF5-47P9", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T22:10:04.727Z", "date_only": false, "value": "2026-11-10T22:10:04.727", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88822", "record": "FKIE_CVE-2026-88822", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-11T01:27:02.790Z", "date_only": false, "value": "2026-11-11T01:27:02.790840Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117595204638713697", "record": "CVE-2026-88822", "field": "creation_timestamp", "uuid": "036b9875-8446-427e-89e9-5c859dc32815", "content": "CVE-2026-88822 QUIC Uses Uninitialized Stack Bytes During Automated Peer Detection Issue summary: QUIC, when performing automated peer detection, may allowuninitialized stack data to leak into the received address which is then usedas the destination for outgoing packets.\nImpact summary: Applications using QUIC's automated peer detection mechanismmay receive an invalid address, leading to connection loss and disclosure ofuninitialized stack data to an attacker observing the outgoing network traffic.\nCWE: CWE-457 (Use of Uninitialized Variable)\nDescription: The OpenSSL QUIC stack contains a feature in which, when using analready connected socket, it will auto-detect the peer address during the SSLhandshake.  This feature uses the getpeername() function, passing a buffer ofsufficient length to hold any supported address family, but passes a bufferlength that is only sized such that larger addresses, such as IPv6, cannot beretrieved. The getpeername() function however, still returns the full addresslength, which is accepted as the valid input buffer length, leading to theaddress buffer containing uninitialized stack data instead of the actual peeraddress. The invalid peer address is then used as destination for the outgoingpackets which leads to a connectivity breakage and a leakage of theuninitialized stack data to passive network observers.\nFIPS impact: noThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE asthe affected protocol is not implemented in the FIPS module.\nhttps://www.cve.org/CVERecord?id=CVE-2026-88822https://openssl-library.org/news/secadv/20261110.txthttps://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75#OpenSSL#CVE_2026_88822#bot", "url": "https://infosec.exchange/users/cve/statuses/117595204638713697"}], "metrics": {"as_of": "2026-11-11T03:59:48.952Z", "anchors": {"origin": {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 104388.952032, "hours": 28.99693112, "days": 1.2082054633333335, "min_seconds": 104388.952032, "max_seconds": 104388.952032, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-09T23:00:00Z", "date_only": false, "value": "2026-11-09T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4443", "record": "WID-SEC-W-2026-4443", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-11T03:59:48.952Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}