Denial-of-service in Quicly QUIC protocol implementation (CVE-2026-44435)

Quicly, an IETF QUIC protocol implementation for use within the H2O HTTP server, contains a denial-of-service vulnerability in which an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB. A remote, unauthenticated attacker can exploit this condition without user interaction to cause process termination. Affected versions: - commits up to dccf5d4 We recommend updating to: commit 8b178e6 and above. CVSS 7.5 · our assessment: this_week Vendor advisory: https://github.com/h2o/quicly/security/advisories/GHSA-2cw9-5673-73gv Details: https://vuln.today/cve/CVE-2026-44435