UBUNTU-CVE-2026-84784 (CVE-2026-84784)

Vulnerability from osv_ubuntu – Published: 2026-09-29 00:00 – Updated: 2026-10-17 09:54 – Source website
VLAI
Details

Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withholds ACKs, then it can force the local stack to allocate ~400MB (depending on ACK delay). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism by which a remote peer can notify the local QUIC stack to change the destination connection ID (a.k.a. CID) the local stack uses to identify the connection at the remote peer. Each CID is associated with a sequence number. The sequence number is transmitted in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID which is being either associated with a connection or retired. The remote peer sends a NEW_CONNECTION_ID frame to let the local stack know a new CID is being associated with an existing connection. The NEW_CONNECTION_ID frame carries the new CID, its sequence number, and the retire-prior-to number. The retire-prior-to identifies existing CIDs that are to be retired. The local QUIC stack must send a RETIRE_CONNECTION_ID for every destination CID whose sequence number is less than retire-prior-to. The CID becomes retired after the local stack receives an ACK for its RETIRE_CONNECTION_ID frame. Although the OpenSSL QUIC stack supports at most one destination CID for every connection, it can be tricked into processing more than one RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC stack currently retires the destination CID as soon as it receives the NEW_CONNECTION_ID, while in fact the destination CID must be retired after an ACK for the RETIRE_CONNECTION_ID frame is received. Correcting the flawed logic also fixes the backlog growth. [1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
N/A (UNKNOWN)
low
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnode72",
            "binary_version": "12.22.9~dfsg-1ubuntu3.6+esm2"
          },
          {
            "binary_name": "nodejs",
            "binary_version": "12.22.9~dfsg-1ubuntu3.6+esm2"
          }
        ],
        "priority_reason": "OpenSSL developers have rated this issue as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "nodejs",
        "purl": "pkg:deb/ubuntu/nodejs@12.22.9~dfsg-1ubuntu3.6+esm2?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.22.5~dfsg-5ubuntu1",
        "12.22.7~dfsg-2ubuntu1",
        "12.22.7~dfsg-2ubuntu3",
        "12.22.9~dfsg-1ubuntu2",
        "12.22.9~dfsg-1ubuntu3",
        "12.22.9~dfsg-1ubuntu3.1",
        "12.22.9~dfsg-1ubuntu3.2",
        "12.22.9~dfsg-1ubuntu3.3",
        "12.22.9~dfsg-1ubuntu3.4",
        "12.22.9~dfsg-1ubuntu3.5",
        "12.22.9~dfsg-1ubuntu3.6",
        "12.22.9~dfsg-1ubuntu3.6+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "efi-shell-aa64",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "efi-shell-loongarch64",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "efi-shell-riscv64",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "efi-shell-x64",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "ovmf",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "ovmf-amdsev",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "ovmf-generic",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "ovmf-inteltdx",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "ovmf-legacy",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "qemu-efi-aarch64",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "qemu-efi-loongarch64",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "qemu-efi-riscv64",
            "binary_version": "2026.05-2ubuntu3"
          }
        ],
        "priority_reason": "OpenSSL developers have rated this issue as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "edk2",
        "purl": "pkg:deb/ubuntu/edk2@2026.05-2ubuntu3?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2025.11-3ubuntu7",
        "2025.11-3ubuntu8",
        "2026.05-2ubuntu1",
        "2026.05-2ubuntu2",
        "2026.05-2ubuntu3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "efi-shell-aa64-hwe",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "efi-shell-loongarch64-hwe",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "efi-shell-riscv64-hwe",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "efi-shell-x64-hwe",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "ovmf-amdsev-hwe",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "ovmf-generic-hwe",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "ovmf-hwe",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "ovmf-inteltdx-hwe",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "ovmf-legacy-hwe",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "qemu-efi-aarch64-hwe",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "qemu-efi-loongarch64-hwe",
            "binary_version": "2026.05-2ubuntu3"
          },
          {
            "binary_name": "qemu-efi-riscv64-hwe",
            "binary_version": "2026.05-2ubuntu3"
          }
        ],
        "priority_reason": "OpenSSL developers have rated this issue as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "edk2-hwe",
        "purl": "pkg:deb/ubuntu/edk2-hwe@2026.05-2ubuntu3?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2025.11-3ubuntu8",
        "2025.11-3ubuntu9",
        "2026.05-2ubuntu1",
        "2026.05-2ubuntu2",
        "2026.05-2ubuntu3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "efi-shell-aa64",
            "binary_version": "2025.11-3ubuntu7.3"
          },
          {
            "binary_name": "efi-shell-loongarch64",
            "binary_version": "2025.11-3ubuntu7.3"
          },
          {
            "binary_name": "efi-shell-riscv64",
            "binary_version": "2025.11-3ubuntu7.3"
          },
          {
            "binary_name": "efi-shell-x64",
            "binary_version": "2025.11-3ubuntu7.3"
          },
          {
            "binary_name": "ovmf",
            "binary_version": "2025.11-3ubuntu7.3"
          },
          {
            "binary_name": "ovmf-amdsev",
            "binary_version": "2025.11-3ubuntu7.3"
          },
          {
            "binary_name": "ovmf-generic",
            "binary_version": "2025.11-3ubuntu7.3"
          },
          {
            "binary_name": "ovmf-inteltdx",
            "binary_version": "2025.11-3ubuntu7.3"
          },
          {
            "binary_name": "ovmf-legacy",
            "binary_version": "2025.11-3ubuntu7.3"
          },
          {
            "binary_name": "qemu-efi-aarch64",
            "binary_version": "2025.11-3ubuntu7.3"
          },
          {
            "binary_name": "qemu-efi-loongarch64",
            "binary_version": "2025.11-3ubuntu7.3"
          },
          {
            "binary_name": "qemu-efi-riscv64",
            "binary_version": "2025.11-3ubuntu7.3"
          }
        ],
        "priority_reason": "OpenSSL developers have rated this issue as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "edk2",
        "purl": "pkg:deb/ubuntu/edk2@2025.11-3ubuntu7.3?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2025.02-8ubuntu3",
        "2025.11-3ubuntu6",
        "2025.11-3ubuntu7",
        "2025.11-3ubuntu7.2",
        "2025.11-3ubuntu7.3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "efi-shell-aa64-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "efi-shell-loongarch64-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "efi-shell-riscv64-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "efi-shell-x64-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "ovmf-amdsev-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "ovmf-generic-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "ovmf-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "ovmf-inteltdx-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "ovmf-legacy-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "qemu-efi-aarch64-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "qemu-efi-loongarch64-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          },
          {
            "binary_name": "qemu-efi-riscv64-hwe",
            "binary_version": "2025.11-3ubuntu8.2"
          }
        ],
        "priority_reason": "OpenSSL developers have rated this issue as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "edk2-hwe",
        "purl": "pkg:deb/ubuntu/edk2-hwe@2025.11-3ubuntu8.2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2025.11-3ubuntu6",
        "2025.11-3ubuntu8",
        "2025.11-3ubuntu8.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libssl3t64",
            "binary_version": "3.5.5-1ubuntu3.6"
          },
          {
            "binary_name": "openssl",
            "binary_version": "3.5.5-1ubuntu3.6"
          },
          {
            "binary_name": "openssl-provider-legacy",
            "binary_version": "3.5.5-1ubuntu3.6"
          }
        ],
        "priority_reason": "OpenSSL developers have rated this issue as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "openssl",
        "purl": "pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.6?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.5.5-1ubuntu3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.5.3-1ubuntu2",
        "3.5.5-1ubuntu1",
        "3.5.5-1ubuntu3",
        "3.5.5-1ubuntu3.2",
        "3.5.5-1ubuntu3.3",
        "3.5.5-1ubuntu3.4",
        "3.5.5-1ubuntu3.5"
      ]
    }
  ],
  "aliases": [],
  "details": "Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withholds ACKs, then it can force the local stack to allocate ~400MB (depending on ACK delay). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism by which a remote peer can notify the local QUIC stack to change the destination connection ID (a.k.a. CID) the local stack uses to identify the connection at the remote peer. Each CID is associated with a sequence number. The sequence number is transmitted in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID which is being either associated with a connection or retired. The remote peer sends a NEW_CONNECTION_ID frame to let the local stack know a new CID is being associated with an existing connection. The NEW_CONNECTION_ID frame carries the new CID, its sequence number, and the retire-prior-to number. The retire-prior-to identifies existing CIDs that are to be retired. The local QUIC stack must send a RETIRE_CONNECTION_ID for every destination CID whose sequence number is less than retire-prior-to. The CID becomes retired after the local stack receives an ACK for its RETIRE_CONNECTION_ID frame. Although the OpenSSL QUIC stack supports at most one destination CID for every connection, it can be tricked into processing more than one RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC stack currently retires the destination CID as soon as it receives the NEW_CONNECTION_ID, while in fact the destination CID must be retired after an ACK for the RETIRE_CONNECTION_ID frame is received. Correcting the flawed logic also fixes the backlog growth. [1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.",
  "id": "UBUNTU-CVE-2026-84784",
  "modified": "2026-10-17T09:54:13Z",
  "published": "2026-09-29T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-84784"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84784"
    },
    {
      "type": "REPORT",
      "url": "https://openssl-library.org/news/secadv/20260929.txt"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8847-1"
    }
  ],
  "related": [
    "USN-8847-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-84784"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.