CVE-2025-15468

Low

Published: —Translated: 16/08/2026(UTC)NVD NIST

Summary

If an application using the `SSL_CIPHER_find()` function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. This leads to abnormal termination of the running process, causing Denial of Service (DoS).

Risk Assessment

The risk is the possibility of remotely causing a process crash, which could lead to service disruption (DoS).

Recommendation

Update to a patched version and protect QUIC applications against unknown cipher suites.

Original NVD description (English source)

Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Serv