CVE-2026-44435
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In the Quicly IETF QUIC protocol implementation, primarily used within the H2O HTTP server, an assertion failure occurs prior to commit 937d0e9. The failure is triggered when the total number of valid handshake messages received over a CRYPTO stream in a single packet number space exceeds 32KB, causing a Denial of Service (DoS).
Risk Assessment
An attacker can send specially crafted handshake messages, causing the H2O server to crash and preventing new QUIC connections from being established. This results in service unavailability for end users.
Recommendation
Immediately update the Quicly library to a version containing commit 937d0e9 or later. If you are using the H2O server, apply the latest version that includes the patched library.
Other vulnerabilities in Quicly
See all- CVE-2026-44436High
Quicly, the QUIC implementation in H2O, before commit 8b178e6 is vulnerable to a DoS attack via connection state corruption. The library accepts Connection IDs up to 255 bytes, but CID buffers are limited to 20 bytes, leading to buffer overrun and assertion failures.
- CVE-2026-44434Medium
Quicly, a QUIC protocol implementation primarily used in the H2O HTTP server, was vulnerable to stateless reset injection before commit dccf5d4 due to missing packet entry validation. This allowed an on-path attacker to reset QUIC connections.
- CVE-2026-44433Medium
In the Quicly implementation of the QUIC protocol, primarily used in the H2O HTTP server, prior to commit 8b178e6, an attacker could send a STREAM frame with a single byte at the largest allowed offset to obtain additional flow control credit. Under certain conditions, this led to memory exhaustion because the application allocated a receive buffer for all out-of-order data up to the largest received offset.
Original NVD description (English source)
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a Denial of Service. This issue has been fixed by commit 937d0e9.