Title: OpenSSL, Description: Resumen del problema: Un par remoto puede agotar la memoria del montón del servidor o cliente QUIC inundándolo con paquetes que contienen tramas PATH_CHALLENGE.

Resumen del impacto: Un par remoto malicioso puede causar una asignación de memoria ilimitada que puede llevar a una terminación anormal de la aplicación que actúa como cliente o servidor QUIC y a una denegación de servicio.

Un par remoto puede agotar la memoria del montón inundando la pila QUIC local con tramas PATH_CHALLENGE. La pila QUIC local asigna una trama PATH_RESPONSE por cada PATH_CHALLENGE que recibe. La trama PATH_RESPONSE asignada se libera solo cuando el par remoto acusa recibo de la trama PATH_RESPONSE, lo cual no será hecho por un par malicioso.

Los módulos FIPS en 4.0, 3.6, 3.5, 3.4 y 3.0 no se ven afectados por este problema. La pila QUIC está fuera del límite del módulo FIPS de OpenSSL.

{"timestamp":"2026-06-10T15:50:50.340971Z","id":"CVE-2026-34183","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"OpenSSL","product":"OpenSSL","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.0.1","versionType":"semver","status":"affected"},{"version":"3.6.0","lessThan":"3.6.3","versionType":"semver","status":"affected"},{"version":"3.5.0","lessThan":"3.5.7","versionType":"semver","status":"affected"},{"version":"3.4.0","lessThan":"3.4.6","versionType":"semver","status":"affected"}]}]

OR
          *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.4.0 up to (excluding) 3.4.6
          *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.5.0 up to (excluding) 3.5.7
          *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.6.0 up to (excluding) 3.6.3
          *cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*

OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517 Types: Patch

OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac Types: Patch

OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac Types: Patch

OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb Types: Patch

OpenSSL Software Foundation: https://openssl-library.org/news/secadv/20260609.txt Types: Vendor Advisory

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517

https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac

https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac

https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb

https://github.com/openssl/security/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517

https://github.com/openssl/security/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac

https://github.com/openssl/security/commit/d2e9efbe4900a373227deb136e8665401404ffac

https://github.com/openssl/security/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb

Issue summary: Remote peer may exhaust heap memory of the QUIC
server or client by flooding it with packets containing PATH_CHALLENGE
frames.

Impact summary: A malicious remote peer can cause an unbounded
memory allocation which can lead to an abnormal termination of the
application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local
QUIC stack with PATH_CHALLENGE frames. The local QUIC stack
allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives.
The allocated PATH_RESPONSE frame gets freed only when the remote
peer acknowledges reception of the PATH_RESPONSE frame which will
not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by
this issue. The QUIC stack is outside of OpenSSL FIPS module
boundary.

CWE-1325

https://github.com/openssl/security/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517

https://github.com/openssl/security/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac

https://github.com/openssl/security/commit/d2e9efbe4900a373227deb136e8665401404ffac

https://github.com/openssl/security/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb

https://openssl-library.org/news/secadv/20260609.txt