From 72fa5569ff4a85b4466d3611ce94264df3651e9f Mon Sep 17 00:00:00 2001 From: Alexandr Nedvedicky Date: Thu, 3 Sep 2026 14:22:40 +0200 Subject: [PATCH] CVE-2026-75804 QUIC connection-level flow control not enforced, remote memory exhaustion Function ossl_quic_rxfc_get_error() must also report flow control violation error for connection level not just for stream level. Ignoring connection level error prevents QUIC stack to enforce flow control. Fixes CVE-2026-75804 Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz Reviewed-by: Andrew Dinh Merge-date: Tue Sep 29 11:58:45 2026 --- ssl/quic/quic_fc.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/ssl/quic/quic_fc.c b/ssl/quic/quic_fc.c index 1691d4d69e..bda6e5b5db 100644 --- a/ssl/quic/quic_fc.c +++ b/ssl/quic/quic_fc.c @@ -393,8 +393,17 @@ int ossl_quic_rxfc_get_error(QUIC_RXFC *rxfc, int clear) { int r = rxfc->error_code; - if (clear) + if (r == OSSL_QUIC_ERR_NO_ERROR && rxfc->parent != NULL) + r = rxfc->parent->error_code; + + /* + * The clear argument is used for testing only. + */ + if (clear) { rxfc->error_code = 0; + if (rxfc->parent != NULL) + rxfc->parent->error_code = 0; + } return r; } -- 2.55.0