CVE-2026-84784 QUIC 栈 NEW_CONNECTION_ID 资源耗尽漏洞
影响攻击者可远程耗尽目标内存资源，导致拒绝服务
该漏洞影响 QUIC 协议栈对 NEW_CONNECTION_ID 帧的处理。恶意远端对等方通过绕过连接 ID 数量限制检查，持续发送 NEW_CONNECTION_ID 帧，迫使本地栈为每个帧回复 RETIRE_CONN_ID 帧。若同时不返回 ACK，可导致本地栈分配约 400MB 内存，造成资源耗尽。
影响范围
受影响的具体产品与版本范围暂无公开信息，涉及实现 RFC 9000 连接 ID 管理机制的 QUIC 协议栈。
漏洞详情
漏洞类型为无限制资源分配（CWE-770）。RFC 9000 规定远端可通过 NEW_CONNECTION_ID 帧通知本地栈关联新的连接 ID，本地栈收到后需回复 RETIRE_CONN_ID 帧。由于缺少对连接 ID 数量的限制检查，攻击者可无限发送该帧，且通过延迟 ACK 使 RETIRE_CONN_ID 帧在控制帧队列中堆积，导致内存被大量占用。
利用条件与风险
利用前提是攻击者能与目标建立 QUIC 连接并控制远端行为，无需认证即可远程触发。实战中可造成内存耗尽型拒绝服务，风险较高。
修复建议
官方修复方案暂无公开信息，建议关注相关 QUIC 实现的安全更新。临时缓解措施包括限制单个连接可关联的连接 ID 数量、对 NEW_CONNECTION_ID 帧进行速率限制，以及及时处理控制帧队列。
Issue summary: A malicious remote peer may flood the local QUIC
stack with NEW_CONNECTION_ID frames by avoiding a limit check on
how many connection IDs the remote QUIC stack can use.
Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame
for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID
frame is dispatched via the Control Frame Queue (CFQ). If the remote
peer also withholds ACKs, then it can force the local stack
to allocate ~400MB (depending on ACK delay).
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism
by which a remote peer can notify the local QUIC stack to change the
destination connection ID (a.k.a. CID) the local stack uses to
identify the connection at the remote peer. Each CID is associated
with a sequence number. The sequence number is transmitted
in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID
which is being either associated with a connection or retired.
The remote peer sends a NEW_CONNECTION_ID frame to let the local stack know
a new CID is being associated with an existing connection. The
NEW_CONNECTION_ID frame carries the new CID, its sequence number, and the
retire-prior-to number. The retire-prior-to identifies existing
CIDs that are to be retired. The local QUIC stack must send a
RETIRE_CONNECTION_ID for every destination CID whose sequence number
is less than retire-prior-to. The CID becomes retired after the
local stack receives an ACK for its RETIRE_CONNECTION_ID frame.
Although the OpenSSL QUIC stack supports at most one destination CID
for every connection, it can be tricked into processing more than
one RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC
stack currently retires the destination CID as soon as it receives
the NEW_CONNECTION_ID, while in fact the destination CID must
be retired after an ACK for the RETIRE_CONNECTION_ID frame is received.
Correcting the flawed logic also fixes the backlog growth.
[1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids
FIPS impact: no
The FIPS module is not affected as the QUIC implementation is outside of
the OpenSSL FIPS module boundary.