CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

Synopsis

This is a heap memory exhaustion vulnerability in the OpenSSL QUIC stack, specifically in the PATH_CHALLENGE frame handler. The flaw is reachable over the network with no authentication required, meaning any remote peer can trigger it. A successful attack causes unbounded heap allocation that crashes the affected QUIC client or server process, resulting in a denial of service. Patched-image rebuilds at versions 3.4.6, 3.5.7, 3.6.3, and 4.0.1 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the target QUIC service over the network and send PATH_CHALLENGE frames to it.

• AuthenticationNot required

  No credentials or session tokens are needed; any remote peer can send PATH_CHALLENGE frames without authenticating.

• Victim interactionNot required

  No user action is required; the vulnerable QUIC stack processes incoming frames automatically without any victim interaction.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, requiring only the ability to flood the target with PATH_CHALLENGE frames, with no race conditions or environmental dependencies to navigate.

Blast Radius

• Heap memory on the target host is consumed without bound until the operating system or allocator refuses further allocations.
• The QUIC client or server process terminates abnormally, dropping all in-flight connections and making the service unavailable to legitimate users.
• Any application state held in the crashed process that had not been persisted is lost.