# CVE-2026-42772: Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC CVE-2026-42772 is fixed in 13 products on 1 platform, first by libssl3t64 3.5.5-1ubuntu3.7, released September 29, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-42772 - Priority: Routine - CVSS: 5.3 (Moderate) - EPSS: 0.0050 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Sep 29, 2026 - Weakness: Inefficient Algorithmic Complexity - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42772 ## Description Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407: Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations, consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libssl3t64 Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.7 | [libssl3t64 3.5.5-1ubuntu3.7](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libssl3t64-3.5.5-1ubuntu3.7.md) | Sep 29, 2026 | | Linux | openssl Debian 13.5 (trixie) | 3.5.7-1~deb13u3 | [DEBIAN-CVE-2026-42772](https://patchblox.com/security/data/fix/linux/debian-cve-2026-42772.md) | Sep 30, 2026 | | Linux | openssl Debian 14 | 3.6.5-1 | [DEBIAN-CVE-2026-42772](https://patchblox.com/security/data/fix/linux/debian-cve-2026-42772.md) | Sep 30, 2026 | | Linux | openssl Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.7 | [openssl 3.5.5-1ubuntu3.7](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-3.5.5-1ubuntu3.7.md) | Sep 29, 2026 | | Linux | openssl amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-debugsource amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-devel amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-fips-provider-latest amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-fips-provider-latest-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-perl amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-provider-legacy Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.7 | [openssl-provider-legacy 3.5.5-1ubuntu3.7](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-provider-legacy-3.5.5-1ubuntu3.7.md) | Sep 29, 2026 | | Linux | openssl-snapsafe-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | | Linux | openssl-snapsafe-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.3 | [ALAS2023-2026-3204](https://patchblox.com/security/data/fix/linux/alas2023-2026-3204.md) | Nov 7, 2026 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.