{"action":"Upgrade openssl to 3.6.5-1 or later.","affected":[{"fixed":"3.6.5-1","introduced":"0"}],"component":"openssl","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["3.6.5-1"],"id":"tcs_01M5NVCKC9D782KXVANXPPHH54","modified_at":"2026-10-08T23:00:11.168800152Z","published_at":"2026-09-29T16:17:10.887Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-75804","https://security-tracker.debian.org/tracker/CVE-2026-75804"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-75804#Debian:14/openssl","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-75804"}],"summary":"Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary"}