CVE-2026-54874 affects OpenSSL's DTLS implementation, where receiving records for a future epoch during a handshake causes excessive memory buffering. The vulnerability stems from OpenSSL retaining the entire 16KB read buffer per record rather than just the record bytes, with up to 100 records buffered per connection, resulting in ~1.7MB retained per connection. This yields a memory amplification factor of approximately 1200x, enabling remote memory exhaustion DoS attacks against DTLS servers. Affected versions include OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2. The issue was reported by Amazon Web Services on 18 May 2026 and fixed by Matt Caswell. Patches are available across all affected branches. Severity is assessed as Low due to bounded per-connection memory and applicability of existing connection limits.