Quicly vulnerabilities

Quicly, the QUIC implementation in H2O, before commit 8b178e6 is vulnerable to a DoS attack via connection state corruption. The library accepts Connection IDs up to 255 bytes, but CID buffers are limited to 20 bytes, leading to buffer overrun and assertion failures.

In the Quicly IETF QUIC protocol implementation, primarily used within the H2O HTTP server, an assertion failure occurs prior to commit 937d0e9. The failure is triggered when the total number of valid handshake messages received over a CRYPTO stream in a single packet number space exceeds 32KB, causing a Denial of Service (DoS).

Quicly, a QUIC protocol implementation primarily used in the H2O HTTP server, was vulnerable to stateless reset injection before commit dccf5d4 due to missing packet entry validation. This allowed an on-path attacker to reset QUIC connections.

In the Quicly implementation of the QUIC protocol, primarily used in the H2O HTTP server, prior to commit 8b178e6, an attacker could send a STREAM frame with a single byte at the largest allowed offset to obtain additional flow control credit. Under certain conditions, this led to memory exhaustion because the application allocated a receive buffer for all out-of-order data up to the largest received offset.