How severe is CVE-2026-34183?

CVE-2026-34183 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-34183 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-34183?

CVE-2026-34183 primarily affects Openssl. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-34183?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-34183 have an EU (EUVD) identifier?

Yes. CVE-2026-34183 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-35479.

When was CVE-2026-34183 published?

CVE-2026-34183 was published on 2026-06-09 and last updated on 2026-06-17.

CVE-2026-34183

CVE-2026-34183 is a high-severity vulnerability in Openssl with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1325.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 1% (40th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-35479
Weakness: CWE-1325
Affected product: Openssl
Published: 2026-06-09
Last modified: 2026-06-17

Description

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Frequently asked questions

What is CVE-2026-34183?: Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.
How severe is CVE-2026-34183?: CVE-2026-34183 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-34183 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-34183?: CVE-2026-34183 primarily affects Openssl. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-34183?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-34183 have an EU (EUVD) identifier?: Yes. CVE-2026-34183 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-35479.
When was CVE-2026-34183 published?: CVE-2026-34183 was published on 2026-06-09 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*

More vulnerabilities in Openssl

CVE-2009-3245 — Critical (CVSS 10.0): OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c,…
CVE-2006-3738 — Critical (CVSS 10.0): Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier…
CVE-2026-31789 — Critical (CVSS 9.8): Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer…
CVE-2022-2274 — Critical (CVSS 9.8): The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA…
CVE-2021-3711 — Critical (CVSS 9.8): In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt().…
CVE-2016-6309 — Critical (CVSS 9.8): statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote…

All CVEs affecting Openssl →

Other CWE-1325 vulnerabilities

CVE-2024-27796 — High (CVSS 7.8): The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS…
CVE-2025-2240 — High (CVSS 7.5): A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This…
CVE-2026-8199 — Medium (CVSS 6.5): An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet,…
CVE-2026-24819 — Medium (CVSS 6.3): Improperly Controlled Sequential Memory Allocation vulnerability in foxinmy weixin4j…
CVE-2024-2511 — Medium (CVSS 5.9): Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3…
CVE-2026-6869 — Medium (CVSS 5.5): WebSocket protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

Browse all CWE-1325 vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE:

46.235.42.53 (ipv4-addr)
159.192.132.34 (ipv4-addr)
157.7.200.152 (ipv4-addr)
157.173.205.202 (ipv4-addr)