CVE WATCH / VULNERABILITY DETAIL
CVE-2026-35191
UNKNOWNCVSS 0NVD feed
Published 29 September 2026 · tracked since 30 September 2026
Description
Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data rec
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog