CVE-2026-44436
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Quicly, the QUIC implementation in H2O, before commit 8b178e6 is vulnerable to a DoS attack via connection state corruption. The library accepts Connection IDs up to 255 bytes, but CID buffers are limited to 20 bytes, leading to buffer overrun and assertion failures.
Risk Assessment
An attacker can send a crafted QUIC packet, causing the application using Quicly to crash, resulting in denial of service.
Recommendation
Update Quicly to a version containing commit 8b178e6 or later, which rejects packets with Connection IDs longer than 20 bytes.
Other vulnerabilities in Quicly
See all- CVE-2026-44435High
In the Quicly IETF QUIC protocol implementation, primarily used within the H2O HTTP server, an assertion failure occurs prior to commit 937d0e9. The failure is triggered when the total number of valid handshake messages received over a CRYPTO stream in a single packet number space exceeds 32KB, causing a Denial of Service (DoS).
- CVE-2026-44434Medium
Quicly, a QUIC protocol implementation primarily used in the H2O HTTP server, was vulnerable to stateless reset injection before commit dccf5d4 due to missing packet entry validation. This allowed an on-path attacker to reset QUIC connections.
- CVE-2026-44433Medium
In the Quicly implementation of the QUIC protocol, primarily used in the H2O HTTP server, prior to commit 8b178e6, an attacker could send a STREAM frame with a single byte at the largest allowed offset to obtain additional flow control credit. Under certain conditions, this led to memory exhaustion because the application allocated a receive buffer for all out-of-order data up to the largest received offset.
Original NVD description (English source)
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, Quicly is vulnerable to a Denial of Service attack through connection state corruption. In QUIC Invariants, the maximum length of a Connection ID is 255 bytes, while QUIC version 1 further restricts the maximum to 20 bytes. Quicly implements QUIC version 1 and therefore its CID buffers are limited to 20 bytes. However, to be able to respond to unknown versions of QUIC, its packet decoder accepts Connection IDs of up to 255 bytes. As its CID buffers are merely 20 bytes long, Quicly must reject QUIC version 1 packets with Connection IDs longer than that. The command line tool bundled with Quicly has had that check, however the library itself lacked such enforcement. As a consequence, when used by applications that lack their own enforcement, the connection state becoming inconsistent to buffer overrun. Fortunately, the overflow stops within the allocated chunk of memory, but nevertheless, the bug leads to assertion failures. This issue has been fixed by commit 8b178e6.