# CVE-2026-63075: QUIC ACK-only Packet Retention Can Cause Memory Exhaustion CVE-2026-63075 is fixed in 14 products on 1 platform, first by libssl3t64 3.5.5-1ubuntu3.4, released August 24, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-63075 - Priority: High - CVSS: 7.5 (Important) - EPSS: 0.0057 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 24, 2026 - Weakness: Allocation of Resources Without Limits or Throttling - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63075 ## Description Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libssl3t64 Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [libssl3t64 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libssl3t64-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 | | Linux | openssl Debian 13.5 (trixie) | 3.5.7-1~deb13u2 | [DEBIAN-CVE-2026-63075](https://patchblox.com/security/data/fix/linux/debian-cve-2026-63075.md) | Aug 26, 2026 | | Linux | openssl Debian 14 | 3.6.4-1 | [DEBIAN-CVE-2026-63075](https://patchblox.com/security/data/fix/linux/debian-cve-2026-63075.md) | Aug 26, 2026 | | Linux | openssl RHEL 10 | 3.5.8-1.el10_2 | [RHSA-2026:67154](https://patchblox.com/security/data/fix/linux/rhsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [openssl 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 | | Linux | openssl almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl rocky 10 | 1:3.5.8-1.el10_2 | [RLSA-2026:67154](https://patchblox.com/security/data/fix/linux/rlsa-2026-67154.md) | Sep 15, 2026 | | Linux | openssl rocky 9 | 1:3.5.8-1.el9_8 | [RLSA-2026:67165](https://patchblox.com/security/data/fix/linux/rlsa-2026-67165.md) | Sep 15, 2026 | | Linux | openssl-3 opensuse-leap 16.0 | 3.5.0-160000.10.1 | [OPENSUSE-SU-2026:21744-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21744-1.md) | Sep 2, 2026 | | Linux | openssl-3 sles 15.7 | 3.5.0-150700.5.50.1 | [SUSE-SU-2026:4039-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4039-1.md) | Sep 7, 2026 | | Linux | openssl-3 sles 16.0 | 3.5.0-160000.10.1 | [SUSE-SU-2026:23609-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23609-1.md) | Sep 2, 2026 | | Linux | openssl-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-debugsource amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-devel RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-devel almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl-devel almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-devel amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-devel ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl-devel ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl-fips-provider-latest amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-fips-provider-latest-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-libs RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-libs almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl-libs almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-libs ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl-libs ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-perl RHEL 9 | 1:3.5.8-1.el9_8 | [RHSA-2026:67165](https://patchblox.com/security/data/fix/linux/rhsa-2026-67165.md) | Sep 19, 2026 | | Linux | openssl-perl almalinux 10 | 1:3.5.8-1.el10_2.alma.1 | [ALSA-2026:67154](https://patchblox.com/security/data/fix/linux/alsa-2026-67154.md) | Sep 14, 2026 | | Linux | openssl-perl almalinux 9 | 1:3.5.8-1.el9_8 | [ALSA-2026:67165](https://patchblox.com/security/data/fix/linux/alsa-2026-67165.md) | Sep 14, 2026 | | Linux | openssl-perl amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-perl ol 10 | 1:3.5.8-1.0.1.el10_2 | [ELSA-2026-67154-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67154-0.md) | Sep 14, 2026 | | Linux | openssl-perl ol 9 | 1:3.5.8-1.0.1.el9_8 | [ELSA-2026-67165-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67165-0.md) | Sep 14, 2026 | | Linux | openssl-provider-legacy Ubuntu 26.04.1 LTS (resolute) | 3.5.5-1ubuntu3.4 | [openssl-provider-legacy 3.5.5-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-openssl-provider-legacy-3.5.5-1ubuntu3.4.md) | Aug 24, 2026 | | Linux | openssl-snapsafe-libs amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | | Linux | openssl-snapsafe-libs-debuginfo amzn 2023 | 1:3.5.8-1.amzn2023.0.1 | [ALAS2023-2026-2136](https://patchblox.com/security/data/fix/linux/alas2023-2026-2136.md) | Sep 14, 2026 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.