# CVE-2026-88822: OpenSSL QUIC uninitialized stack data leak in peer detection

Source: https://junglewise.ai/threats/cve-2026-88822-issue-summary-quic-when-performing-automated-peer-detection-may  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-88822 · Severity: info · Published 2026-11-10

OpenSSL's QUIC implementation includes a feature to automatically detect peer addresses on connected sockets during the SSL handshake. A buffer size miscalculation causes uninitialized stack memory to be included in the peer address, which is then used as the destination for outgoing packets. This leads to connection failures and potential disclosure of sensitive stack data to network observers.

Technologies: [OpenSSL](https://junglewise.ai/threats/technologies/openssl). Vendors: [OpenSSL](https://junglewise.ai/threats/vendors/openssl).

## Quick answers

**Is CVE-2026-88822 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88822 being exploited in the wild.

**How severe is CVE-2026-88822?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** OpenSSL 3.0, 3.4, 3.5, 3.6, 4.0 (QUIC implementation).

**Is there a fix for CVE-2026-88822?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88822 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-88822?** Check whether you run OpenSSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The BIO_dgram_detect_peer_addr() function in the QUIC stack passes a buffer sized for IPv4 addresses (16 bytes) to getpeername(), but the function returns the full address length for IPv6 and other address families (28+ bytes), resulting in uninitialized stack data beyond the valid portion. The invalid peer address is then used as the destination for outgoing packets, causing connectivity loss and leaking stack memory on the wire. The fix initializes the buffer to zero and passes the correct full buffer size to getpeername().

## Affected products

- OpenSSL OpenSSL 3.0, 3.4, 3.5, 3.6, 4.0 (QUIC implementation)

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75](https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75)
- [https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88](https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88)

## Related threats

- [OpenSSL AES-GCM-SIV heap out-of-bounds read in EVP_CipherInit_ex](https://junglewise.ai/threats/cve-2026-95692-issue-summary-setting-an-aes-gcm-siv-iv-shorter-than-the-expected)
- [OpenSSL use-after-free in QUIC CRYPTO frame handling](https://junglewise.ai/threats/cve-2026-95691-issue-summary-a-retransmitted-quic-crypto-frame-can-release)
- [OpenSSL AES-GCM-SIV authentication tag bypass in AAD processing](https://junglewise.ai/threats/cve-2026-88823-issue-summary-the-aes-gcm-siv-implementation-treats-a-zero-length)
- [OpenSSL infinite loop in CMS encryption with EC certificates](https://junglewise.ai/threats/cve-2026-107496-issue-summary-encrypting-a-cms-message-to-an-ec-certificate)
- [OpenSSL QUIC denial of service via NEW_CONNECTION_ID frame flooding](https://junglewise.ai/threats/cve-2026-84784-issue-summary-a-malicious-remote-peer-may-flood-the-local-quic)