Is CVE-2026-88822 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88822 being exploited in the wild.

How severe is CVE-2026-88822?

Informational severity, published 10 November 2026.

Which products and versions are affected?

OpenSSL 3.0, 3.4, 3.5, 3.6, 4.0 (QUIC implementation).

Is there a fix for CVE-2026-88822?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-88822 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-88822?

Check whether you run OpenSSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88822: OpenSSL QUIC uninitialized stack data leak in peer detection

CVE-2026-88822 · Severity: info · Published 2026-11-10

OpenSSL's QUIC implementation includes a feature to automatically detect peer addresses on connected sockets during the SSL handshake. A buffer size miscalculation causes uninitialized stack memory to be included in the peer address, which is then used as the destination for outgoing packets. This leads to connection failures and potential disclosure of sensitive stack data to network observers.

Technologies: OpenSSL. Vendors: OpenSSL.

Quick answers

Is CVE-2026-88822 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88822 being exploited in the wild.
How severe is CVE-2026-88822?: Informational severity, published 10 November 2026.
Which products and versions are affected?: OpenSSL 3.0, 3.4, 3.5, 3.6, 4.0 (QUIC implementation).
Is there a fix for CVE-2026-88822?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88822 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-88822?: Check whether you run OpenSSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The BIO_dgram_detect_peer_addr() function in the QUIC stack passes a buffer sized for IPv4 addresses (16 bytes) to getpeername(), but the function returns the full address length for IPv6 and other address families (28+ bytes), resulting in uninitialized stack data beyond the valid portion. The invalid peer address is then used as the destination for outgoing packets, causing connectivity loss and leaking stack memory on the wire. The fix initializes the buffer to zero and passes the correct full buffer size to getpeername().

Affected products

OpenSSL OpenSSL 3.0, 3.4, 3.5, 3.6, 4.0 (QUIC implementation)

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.