{"action":"Upgrade openssl to 3.5.7-1~deb13u3 or later.","affected":[{"fixed":"3.5.7-1~deb13u3","introduced":"0"}],"component":"openssl","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["3.5.7-1~deb13u3"],"id":"tcs_01M5NVCK8E0H5VR5GDNRZ1YTNA","modified_at":"2026-10-08T23:00:11.168800152Z","published_at":"2026-09-29T16:17:10.887Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-75804","https://security-tracker.debian.org/tracker/CVE-2026-75804"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-75804","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-75804"}],"summary":"Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary"}