Vulnerability-Lookup

CVE-2026-75804 (GCVE-0-2026-75804)

Vulnerability from cvelistv5 – Published: 2026-09-29 15:32 – Updated: 2026-09-29 17:15

Title

QUIC Connection-Level Flow Control is Not Enforced for Streams

Summary

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The local QUIC stack advertises two flow control limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer must follow both limits when transmitting stream data. Whenever the local QUIC stack receives a stream frame, it validates that the size of the received stream frame stays within flow control limits. If either limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a flow control error. The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-level limit. To exploit the issue, three conditions must be met: - the remote peer opens several streams - each stream must stay within the stream-level flow control limit - there must be no zero-offset byte sent on any of the streams (to prevent the vulnerable QUIC stack from consuming data). By meeting the conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 17:15 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

openssl mitre root Scorecard

References

5 references

URL	Tags
https://openssl-library.org/news/secadv/20260929.txt	vendor-advisory
https://github.com/openssl/openssl/commit/64d3102…	patch
https://github.com/openssl/openssl/commit/2e8f546…	patch
https://github.com/openssl/openssl/commit/4533ee8…	patch
https://github.com/openssl/openssl/commit/f9eaecf…	patch

Impacted products

1 product

Vendor	Product	Version	CPE status
OpenSSL	OpenSSL	Affected: 4.0.0 , < 4.0.3 (semver) Affected: 3.6.0 , < 3.6.5 (semver) Affected: 3.5.0 , < 3.5.9 (semver) Affected: 3.4.0 , < 3.4.8 (semver)	guessed

Date Public

2026-09-29 14:21

Credits

Moltenbit Bhabani Sankar Das Saiyowa Security Team Alexandr Nedvedicky

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-75804",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T17:15:09.218928Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T17:15:40.043Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.3",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.5",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.9",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.8",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Moltenbit"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Bhabani Sankar Das"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Saiyowa Security Team"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Alexandr Nedvedicky"
        }
      ],
      "datePublic": "2026-09-29T14:21:57.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: OpenSSL QUIC stack does not enforce connection\u003cbr\u003elevel flow control for streams. Remote peers may send more bytes\u003cbr\u003eas long as they fit within the stream flow control limits.\u003cbr\u003e\u003cbr\u003eImpact summary: A malicious remote peer may exploit the lack of connection\u003cbr\u003eflow control for streams to make the QUIC stack receive ~100MB of memory\u003cbr\u003einstead of 768 KiB (default flow control window size).\u003cbr\u003e\u003cbr\u003eCWE: CWE-770: Allocation of Resources Without Limits or Throttling\u003cbr\u003e\u003cbr\u003eDescription: The local QUIC stack advertises two flow control limits\u003cbr\u003eto its remote peer: stream flow control limit and connection flow\u003cbr\u003econtrol limit. The remote peer must follow both limits when transmitting\u003cbr\u003estream data.\u003cbr\u003e\u003cbr\u003eWhenever the local QUIC stack receives a stream frame, it validates\u003cbr\u003ethat the size of the received stream frame stays within flow control limits.\u003cbr\u003eIf either limit is exceeded (stream level or connection level), then\u003cbr\u003ethe QUIC stack must close the connection with a flow control error.\u003cbr\u003e\u003cbr\u003eThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\u003cbr\u003ethe connection-level limit. To exploit the issue, three conditions must be met:\u003cbr\u003e  - the remote peer opens several streams\u003cbr\u003e  - each stream must stay within the stream-level flow control limit\u003cbr\u003e  - there must be no zero-offset byte sent on any of the streams\u003cbr\u003e    (to prevent the vulnerable QUIC stack from consuming data).\u003cbr\u003eBy meeting the conditions above, the remote peer may make the local stack\u003cbr\u003eallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\u003cbr\u003eof memory. MAX_STREAMS defaults to 100, and the limit applies to both\u003cbr\u003ebidirectional and unidirectional streams, making it 200 in total. The default\u003cbr\u003eflow control window for a stream is 512kB. The remote peer may\u003cbr\u003eforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\u003cbr\u003e\u003cbr\u003eFIPS impact: no\u003cbr\u003eThe FIPS module is not affected as the QUIC implementation is outside of\u003cbr\u003ethe OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T15:32:19.335Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260929.txt"
        },
        {
          "name": "4.0.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a"
        },
        {
          "name": "3.6.5 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e"
        },
        {
          "name": "3.5.9 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538"
        },
        {
          "name": "3.4.8 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "QUIC Connection-Level Flow Control is Not Enforced for Streams",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-75804",
    "datePublished": "2026-09-29T15:32:19.335Z",
    "dateReserved": "2026-08-18T09:34:32.659Z",
    "dateUpdated": "2026-09-29T17:15:40.043Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "OpenSSL",
                "vendor": "OpenSSL",
                "versions": [
                  {
                    "lessThan": "4.0.3",
                    "status": "affected",
                    "version": "4.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.6.5",
                    "status": "affected",
                    "version": "3.6.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.5.9",
                    "status": "affected",
                    "version": "3.5.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.4.8",
                    "status": "affected",
                    "version": "3.4.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "openssl-security@openssl.org"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."
          }
        ],
        "id": "CVE-2026-75804",
        "lastModified": "2026-09-29T21:27:41.130",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-75804",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T17:15:09.218928Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-29T16:17:10.887",
        "references": [
          {
            "source": "openssl-security@openssl.org",
            "url": "https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e"
          },
          {
            "source": "openssl-security@openssl.org",
            "url": "https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538"
          },
          {
            "source": "openssl-security@openssl.org",
            "url": "https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a"
          },
          {
            "source": "openssl-security@openssl.org",
            "url": "https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03"
          },
          {
            "source": "openssl-security@openssl.org",
            "url": "https://openssl-library.org/news/secadv/20260929.txt"
          }
        ],
        "sourceIdentifier": "openssl-security@openssl.org",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "openssl-security@openssl.org",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-30T08:38:06+00:00",
      "cve": "CVE-2026-75804",
      "id": "CVE-2026-75804",
      "initial_release_date": "2026-09-29T15:32:19.335000+00:00",
      "product_status:known_affected": "66",
      "product_status:known_not_affected": "22",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75804.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "LOW",
                  "baseScore": 5.3,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-75804",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-29T17:15:09.218928Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-29T17:15:36.659Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "OpenSSL",
              "vendor": "OpenSSL",
              "versions": [
                {
                  "lessThan": "4.0.3",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "3.6.5",
                  "status": "affected",
                  "version": "3.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "3.5.9",
                  "status": "affected",
                  "version": "3.5.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "3.4.8",
                  "status": "affected",
                  "version": "3.4.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "Moltenbit"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Bhabani Sankar Das"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Saiyowa Security Team"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Alexandr Nedvedicky"
            }
          ],
          "datePublic": "2026-09-29T14:21:57.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Issue summary: OpenSSL QUIC stack does not enforce connection\u003cbr\u003elevel flow control for streams. Remote peers may send more bytes\u003cbr\u003eas long as they fit within the stream flow control limits.\u003cbr\u003e\u003cbr\u003eImpact summary: A malicious remote peer may exploit the lack of connection\u003cbr\u003eflow control for streams to make the QUIC stack receive ~100MB of memory\u003cbr\u003einstead of 768 KiB (default flow control window size).\u003cbr\u003e\u003cbr\u003eCWE: CWE-770: Allocation of Resources Without Limits or Throttling\u003cbr\u003e\u003cbr\u003eDescription: The local QUIC stack advertises two flow control limits\u003cbr\u003eto its remote peer: stream flow control limit and connection flow\u003cbr\u003econtrol limit. The remote peer must follow both limits when transmitting\u003cbr\u003estream data.\u003cbr\u003e\u003cbr\u003eWhenever the local QUIC stack receives a stream frame, it validates\u003cbr\u003ethat the size of the received stream frame stays within flow control limits.\u003cbr\u003eIf either limit is exceeded (stream level or connection level), then\u003cbr\u003ethe QUIC stack must close the connection with a flow control error.\u003cbr\u003e\u003cbr\u003eThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\u003cbr\u003ethe connection-level limit. To exploit the issue, three conditions must be met:\u003cbr\u003e  - the remote peer opens several streams\u003cbr\u003e  - each stream must stay within the stream-level flow control limit\u003cbr\u003e  - there must be no zero-offset byte sent on any of the streams\u003cbr\u003e    (to prevent the vulnerable QUIC stack from consuming data).\u003cbr\u003eBy meeting the conditions above, the remote peer may make the local stack\u003cbr\u003eallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\u003cbr\u003eof memory. MAX_STREAMS defaults to 100, and the limit applies to both\u003cbr\u003ebidirectional and unidirectional streams, making it 200 in total. The default\u003cbr\u003eflow control window for a stream is 512kB. The remote peer may\u003cbr\u003eforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\u003cbr\u003e\u003cbr\u003eFIPS impact: no\u003cbr\u003eThe FIPS module is not affected as the QUIC implementation is outside of\u003cbr\u003ethe OpenSSL FIPS module boundary."
                }
              ],
              "value": "Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."
            }
          ],
          "metrics": [
            {
              "format": "other",
              "other": {
                "content": {
                  "text": "Low"
                },
                "type": "https://openssl-library.org/policies/general/security-policy/"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-29T15:32:19.335Z",
            "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
            "shortName": "openssl"
          },
          "references": [
            {
              "name": "OpenSSL Advisory",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://openssl-library.org/news/secadv/20260929.txt"
            },
            {
              "name": "4.0.3 git commit",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a"
            },
            {
              "name": "3.6.5 git commit",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e"
            },
            {
              "name": "3.5.9 git commit",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538"
            },
            {
              "name": "3.4.8 git commit",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "QUIC Connection-Level Flow Control is Not Enforced for Streams",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "assignerShortName": "openssl",
        "cveId": "CVE-2026-75804",
        "datePublished": "2026-09-29T15:32:19.335Z",
        "dateReserved": "2026-08-18T09:34:32.659Z",
        "dateUpdated": "2026-09-29T17:15:40.043Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-75804

Vulnerability from fkie_nvd - Published: 2026-09-29 16:17 - Updated: 2026-09-29 21:27

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	openssl-security@openssl.org	https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e
	openssl-security@openssl.org	https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538
	openssl-security@openssl.org	https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a
	openssl-security@openssl.org	https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03
	openssl-security@openssl.org	https://openssl-library.org/news/secadv/20260929.txt

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.3",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.5",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.9",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.8",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "openssl-security@openssl.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."
    }
  ],
  "id": "CVE-2026-75804",
  "lastModified": "2026-09-29T21:27:41.130",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-75804",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-29T17:15:09.218928Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-29T16:17:10.887",
  "references": [
    {
      "source": "openssl-security@openssl.org",
      "url": "https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e"
    },
    {
      "source": "openssl-security@openssl.org",
      "url": "https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538"
    },
    {
      "source": "openssl-security@openssl.org",
      "url": "https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a"
    },
    {
      "source": "openssl-security@openssl.org",
      "url": "https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03"
    },
    {
      "source": "openssl-security@openssl.org",
      "url": "https://openssl-library.org/news/secadv/20260929.txt"
    }
  ],
  "sourceIdentifier": "openssl-security@openssl.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "openssl-security@openssl.org",
      "type": "Secondary"
    }
  ]
}

GHSA-GJMH-WX93-R4PW

Vulnerability from github – Published: 2026-09-29 18:31 – Updated: 2026-09-29 18:31

Details

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits.

Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size).

CWE: CWE-770: Allocation of Resources Without Limits or Throttling

Description: The local QUIC stack advertises two flow control limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer must follow both limits when transmitting stream data.

Whenever the local QUIC stack receives a stream frame, it validates that the size of the received stream frame stays within flow control limits. If either limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a flow control error.

The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-level limit. To exploit the issue, three conditions must be met: - the remote peer opens several streams - each stream must stay within the stream-level flow control limit - there must be no zero-offset byte sent on any of the streams (to prevent the vulnerable QUIC stack from consuming data). By meeting the conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection.

FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-75804"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-29T16:17:10Z",
    "severity": "MODERATE"
  },
  "details": "Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n  - the remote peer opens several streams\n  - each stream must stay within the stream-level flow control limit\n  - there must be no zero-offset byte sent on any of the streams\n    (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.",
  "id": "GHSA-gjmh-wx93-r4pw",
  "modified": "2026-09-29T18:31:44Z",
  "published": "2026-09-29T18:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75804"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03"
    },
    {
      "type": "WEB",
      "url": "https://openssl-library.org/news/secadv/20260929.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

UBUNTU-CVE-2026-75804 (CVE-2026-75804)

Vulnerability from osv_ubuntu – Published: 2026-09-29 00:00 – Updated: 2026-09-29 00:00 – Source website

Details

QUIC Connection-Level Flow Control is Not Enforced for Streams

Severity

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2026-75804	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-75804	REPORT
	https://ubuntu.com/security/notices/USN-8847-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnode72",
            "binary_version": "12.22.9~dfsg-1ubuntu3.6+esm2"
          },
          {
            "binary_name": "nodejs",
            "binary_version": "12.22.9~dfsg-1ubuntu3.6+esm2"
          }
        ],
        "priority_reason": "OpenSSL developers have rated this issue as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "nodejs",
        "purl": "pkg:deb/ubuntu/nodejs@12.22.9~dfsg-1ubuntu3.6+esm2?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.22.5~dfsg-5ubuntu1",
        "12.22.7~dfsg-2ubuntu1",
        "12.22.7~dfsg-2ubuntu3",
        "12.22.9~dfsg-1ubuntu2",
        "12.22.9~dfsg-1ubuntu3",
        "12.22.9~dfsg-1ubuntu3.1",
        "12.22.9~dfsg-1ubuntu3.2",
        "12.22.9~dfsg-1ubuntu3.3",
        "12.22.9~dfsg-1ubuntu3.4",
        "12.22.9~dfsg-1ubuntu3.5",
        "12.22.9~dfsg-1ubuntu3.6",
        "12.22.9~dfsg-1ubuntu3.6+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "efi-shell-aa64",
            "binary_version": "2025.11-3ubuntu7.2"
          },
          {
            "binary_name": "efi-shell-loongarch64",
            "binary_version": "2025.11-3ubuntu7.2"
          },
          {
            "binary_name": "efi-shell-riscv64",
            "binary_version": "2025.11-3ubuntu7.2"
          },
          {
            "binary_name": "efi-shell-x64",
            "binary_version": "2025.11-3ubuntu7.2"
          },
          {
            "binary_name": "ovmf",
            "binary_version": "2025.11-3ubuntu7.2"
          },
          {
            "binary_name": "ovmf-amdsev",
            "binary_version": "2025.11-3ubuntu7.2"
          },
          {
            "binary_name": "ovmf-generic",
            "binary_version": "2025.11-3ubuntu7.2"
          },
          {
            "binary_name": "ovmf-inteltdx",
            "binary_version": "2025.11-3ubuntu7.2"
          },
          {
            "binary_name": "ovmf-legacy",
            "binary_version": "2025.11-3ubuntu7.2"
          },
          {
            "binary_name": "qemu-efi-aarch64",
            "binary_version": "2025.11-3ubuntu7.2"
          },
          {
            "binary_name": "qemu-efi-loongarch64",
            "binary_version": "2025.11-3ubuntu7.2"
          },
          {
            "binary_name": "qemu-efi-riscv64",
            "binary_version": "2025.11-3ubuntu7.2"
          }
        ],
        "priority_reason": "OpenSSL developers have rated this issue as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "edk2",
        "purl": "pkg:deb/ubuntu/edk2@2025.11-3ubuntu7.2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2025.02-8ubuntu3",
        "2025.11-3ubuntu6",
        "2025.11-3ubuntu7",
        "2025.11-3ubuntu7.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "efi-shell-aa64-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "efi-shell-loongarch64-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "efi-shell-riscv64-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "efi-shell-x64-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "ovmf-amdsev-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "ovmf-generic-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "ovmf-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "ovmf-inteltdx-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "ovmf-legacy-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "qemu-efi-aarch64-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "qemu-efi-loongarch64-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "qemu-efi-riscv64-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          }
        ],
        "priority_reason": "OpenSSL developers have rated this issue as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "edk2-hwe",
        "purl": "pkg:deb/ubuntu/edk2-hwe@2025.11-3ubuntu8.2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2025.11-3ubuntu6",
        "2025.11-3ubuntu8",
        "2025.11-3ubuntu8.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libssl3t64",
            "binary_version": "3.5.5-1ubuntu3.6"
          },
          {
            "binary_name": "openssl",
            "binary_version": "3.5.5-1ubuntu3.6"
          },
          {
            "binary_name": "openssl-provider-legacy",
            "binary_version": "3.5.5-1ubuntu3.6"
          }
        ],
        "priority_reason": "OpenSSL developers have rated this issue as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "openssl",
        "purl": "pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.6?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.5.5-1ubuntu3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.5.3-1ubuntu2",
        "3.5.5-1ubuntu1",
        "3.5.5-1ubuntu3",
        "3.5.5-1ubuntu3.2",
        "3.5.5-1ubuntu3.3",
        "3.5.5-1ubuntu3.4",
        "3.5.5-1ubuntu3.5"
      ]
    }
  ],
  "aliases": [],
  "details": "QUIC Connection-Level Flow Control is Not Enforced for Streams",
  "id": "UBUNTU-CVE-2026-75804",
  "modified": "2026-09-29T00:00:00Z",
  "published": "2026-09-29T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-75804"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75804"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8847-1"
    }
  ],
  "related": [
    "USN-8847-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-75804"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-75804 (GCVE-0-2026-75804)

FKIE_CVE-2026-75804

GHSA-GJMH-WX93-R4PW

UBUNTU-CVE-2026-75804 (CVE-2026-75804)

Tags

Sightings

Nomenclature

Related by attack behaviour