Abhinav Agarwal

**Name of the Vulnerable Software and Affected Versions** OpenSSL (affected versions not specified) **Description** A remote peer can cause unbounded memory allocation leading to a Denial of Service and abnormal termination of an application acting as a QUIC client or server. This occurs when a malicious peer floods the local QUIC stack with PATH CHALLENGE frames. The stack allocates a PATH RESPONSE frame for every received PATH CHALLENGE, but these frames are only freed once the remote peer acknowledges their reception, which a malicious actor will not do, resulting in heap memory exhaustion. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.