# CVE-2026-18798: openssl: Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial... CVE-2026-18798 is fixed in 14 products on 1 platform, first by libssl3t64 3.5.5-1ubuntu3.4, released August 24, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-18798 - Priority: High - CVSS: 7.5 (high) - EPSS: 0.0170 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 24, 2026 ## Description Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libssl3t64 Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [libssl3t64 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libssl3t64-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 | | Linux | openssl Debian 13.5 (trixie) | 3.5.7-1~deb13u2 | [DEBIAN-CVE-2026-18798](https://patchblox.com/security/data/fix/linux/debian-cve-2026-18798.md) | Aug 26, 2026 | | Linux | openssl Debian 14 | 3.6.4-1 | [DEBIAN-CVE-2026-18798](https://patchblox.com/security/data/fix/linux/debian-cve-2026-18798.md) | Aug 26, 2026 | | Linux | openssl RHEL 10 | 3.5.8-1.el10_2 | [RHSA-2026:67154](https://patchblox.com/security/data/fix/linux/rhsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [openssl 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 | | Linux | openssl almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl rocky 10 | 1:3.5.8-1.el10_2 | [RLSA-2026:67154](https://patchblox.com/security/data/fix/linux/rlsa-2026-67154.md) | Sep 15, 2026 | | Linux | openssl rocky 9 | 1:3.5.8-1.el9_8 | [RLSA-2026:67165](https://patchblox.com/security/data/fix/linux/rlsa-2026-67165.md) | Sep 15, 2026 | | Linux | openssl-3 opensuse-leap 16.0 | 3.5.0-160000.10.1 | [OPENSUSE-SU-2026:21744-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21744-1.md) | Sep 2, 2026 | | Linux | openssl-3 sles 15.7 | 3.5.0-150700.5.50.1 | [SUSE-SU-2026:4039-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4039-1.md) | Sep 7, 2026 | | Linux | openssl-3 sles 16.0 | 3.5.0-160000.10.1 | [SUSE-SU-2026:23609-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23609-1.md) | Sep 2, 2026 | | Linux | openssl-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-debugsource amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-devel RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-devel almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl-devel almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-devel amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-devel ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl-devel ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl-fips-provider-latest amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-fips-provider-latest-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-libs RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-libs almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl-libs almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-libs ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl-libs ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-perl RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-perl almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl-perl almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-perl amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-perl ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl-perl ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl-provider-legacy Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [openssl-provider-legacy 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-provider-legacy-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 | | Linux | openssl-snapsafe-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-snapsafe-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.