Commit 24a394e0b9 for openssl.org

commit 24a394e0b9c0afded88f57343fd491d26ca5bd5f
Author: Matt Caswell <matt@openssl.foundation>
Date:   Tue Jun 23 12:06:56 2026 +0100

    ssl/record/methods/dtls_meth.c: lower the unprocessed_rcds queue limit

    100 buffered next-epoch records is far more than a normal handshake
    ever needs. A peer that has already completed its side of the epoch
    transition may send more than one record under the new epoch before
    we catch up and bump our own receive epoch - for example, application
    data sent immediately once the peer considers the handshake done -
    but real-world bursts like that are still small. Now that each entry
    only costs as much memory as the record actually received, the limit
    mainly serves as a ceiling on worst-case per-connection memory use, so
    lower it to 16 to keep that ceiling smaller while still leaving ample
    headroom over legitimate usage.

    Assisted-by: Claude:claude-sonnet-4-6
    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Merge-date: Mon Aug 24 15:37:51 2026

diff --git a/ssl/record/methods/dtls_meth.c b/ssl/record/methods/dtls_meth.c
index c0323d6f22..f8b1bf5fb7 100644
--- a/ssl/record/methods/dtls_meth.c
+++ b/ssl/record/methods/dtls_meth.c
@@ -287,7 +287,7 @@ static int dtls_rlayer_buffer_record(OSSL_RECORD_LAYER *rl, struct pqueue_st *qu
     pitem *item;

     /* Limit the size of the queue to prevent DOS attacks */
-    if (pqueue_size(queue) >= 100)
+    if (pqueue_size(queue) >= 16)
         return 0;

     rdata = OPENSSL_malloc(sizeof(*rdata));