OpenSSL QUIC server can exhaust memory with many connections

The OpenSSL component that handles QUIC traffic will create a new connection entry for each incoming request, even if the application is not ready to accept it. An attacker who sends a large number of initial QUIC packets can cause the server to consume unlimited memory, eventually making the service unavailable. Update OpenSSL to the version that adds a default limit of 256 pending connections, or configure a lower limit using the provided settings.

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

• https://advisory.echohq.com/cve/CVE-2026-14456 URL
• https://www.cve.org/CVERecord?id=CVE-2026-14456 URL