CVE-2026-42772

MEDIUMPre-NVD 5.35.3—
EchelonGraph scoreHIGH confidence

Score 5.3 from GitHub Security Advisory published 2026-09-29. CISA-ADP (Vulnrichment) CVSS v3.1 baseline 5.3; sources differ by 0.0.

Triggered by: GitHub Security Advisory CVSS
Sources: cisa-adp, epss, ghsa
Trending — Patch released this week
5.3EG
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • Lower severity and no public exploit yet
CISA-KEV: Not listedEPSS PROB: 0.3%CVSS: 5.3Exploit: None knownExposed services: Not assessed

A fix is available — apply it.

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data.

Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth.

CWE: CWE-407: Inefficient Algorithmic Complexity

Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a head-to-tail linear search for any fragment that does not immediately follow the current tail.

By manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations, consuming excessive CPU time for the QUIC process.

FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.

CVSS v3
5.3
EG Score
5.3MEDIUMhigh confidence
EG Risk
39
EG Risk 39/100CISA SSVC

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity53% × 45%
Exploitation0% × 40%
Automatability100% × 15%
CISA SSVC: Track at low or medium mission impact; Attend at high (mission-essential systems).
Action: A fix is available. Apply it within your standard update timelines at low or medium mission impact and sooner than that at high.
EPSS PROB
0.3%
EPSS %ILE
23rd
KEV
Not listed

CISA SSVCTrack at low or medium mission impact; Attend at high (mission-essential systems).

A fix is available. Apply it within your standard update timelines at low or medium mission impact and sooner than that at high.

Exploitation none (CISA Vulnrichment) · Automatable yes (CISA Vulnrichment) · Technical impact partial (CISA Vulnrichment). Mission impact is CISA's Mission & Well-being decision point, and only you can judge it: high means the affected system is essential to your organisation's mission, or its compromise could cause irreversible harm to people. CISA's decision table

Published

September 29, 2026

Last Modified

September 30, 2026

Advisory Details (5)

Auto-updated Sep 30, 2026
Patch available. Sources: github_commit.
generic
https://openssl-library.org/news/secadv/20260929.txt
github_commit

commit f42ae513bbda (openssl/openssl)

Fix landed in openssl/openssl commit f42ae513bbda — awaiting tagged release

https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a
github_commit

commit eb2becc0a4ba (openssl/openssl)

Fix landed in openssl/openssl commit eb2becc0a4ba — awaiting tagged release

https://github.com/openssl/openssl/commit/eb2becc0a4baea7f3050a247834d0e5c2ebe1773
github_commit

commit ca8402e273af (openssl/openssl)

Fix landed in openssl/openssl commit ca8402e273af — awaiting tagged release

https://github.com/openssl/openssl/commit/ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e
github_commit

commit 32d0ed8afe1b (openssl/openssl)

Fix landed in openssl/openssl commit 32d0ed8afe1b — awaiting tagged release

https://github.com/openssl/openssl/commit/32d0ed8afe1b8c3e7ece725b44663da3d7087a09

Vendor Advisories for CVE-2026-42772(4)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Patch Availability(3)

Vendor / EcosystemFixed in / PatchReleasedSource
ubuntuopenssl-provider-legacy (3.5.5-1ubuntu3.7) @ resolute2026-10-03ubuntu
redhatopenssl-main-3.5.9-0.1.hum12026-09-30redhat
redhatopenssl3-main-3.5.9-0.1.hum12026-09-30redhat

Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

Additional Vendor Advisories

(1)

Vendors that published advisories for this CVE beyond the curated set above. Broader coverage but minimal per-row detail — click through for the original advisory.

Data Freshness Timeline

(refreshed 20× in last 7d / 20× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-10-03 21:38 UTCEG score recompute
  2. 2026-10-03 21:38 UTCVendor advisory
  3. 2026-10-03 21:38 UTCGHSA enrichment
  4. 2026-10-03 14:25 UTCEPSS rescore
  5. 2026-10-02 21:35 UTCEG score recompute
  6. 2026-10-02 21:35 UTCVendor advisory
  7. 2026-10-02 21:35 UTCGHSA enrichment
  8. 2026-10-01 21:32 UTCEG score recompute
  9. 2026-10-01 21:32 UTCVendor advisory
  10. 2026-10-01 21:32 UTCGHSA enrichment
  11. 2026-10-01 19:50 UTCEPSS rescore
  12. 2026-09-30 21:29 UTCGHSA enrichment
  13. 2026-09-30 20:26 UTCEG score recompute▲ 5.30
  14. 2026-09-30 20:26 UTCGHSA enrichment
  15. 2026-09-30 20:25 UTCMITRE cvelistV5CVSS v3 → 5.3 · severity → MEDIUM
  16. 2026-09-30 15:03 UTCEPSS rescore
  17. 2026-09-29 22:00 UTCGHSA enrichment
  18. 2026-09-29 16:24 UTCNVD update
  19. 2026-09-29 15:38 UTCEG score recompute
  20. 2026-09-29 15:38 UTCMITRE cvelistV5first tracked

Related CVEs(same vendor + same CWE)

Frequently asked(5)

What is CVE-2026-42772?
CVE-2026-42772 is a medium vulnerability published on September 29, 2026. Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer…
When was CVE-2026-42772 disclosed?
CVE-2026-42772 was first published on September 29, 2026, with the most recent update on September 30, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-42772 actively exploited?
CVE-2026-42772 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0.3% probability of exploitation in the next 30 days (23rd percentile of EPSS-scored CVEs).
What is the CVSS score of CVE-2026-42772?
CVE-2026-42772 has a CVSS v3.1 base score of 5.3 (CISA-ADP / Vulnrichment enrichment; NVD's own analysis pending).
How do I remediate CVE-2026-42772?
A fix for CVE-2026-42772 is available: update to the fixed version the vendor names in its advisory. The vendor advisories EchelonGraph has for CVE-2026-42772 are linked in the Vendor Advisories panel on this page.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-42772

Explore →

Is Your Infrastructure Affected by CVE-2026-42772?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Book a Demo →Browse All CVEs