Denial of Service in Quicly (CVE-2026-44436)

CVE-2026-44436 is a Denial of Service vulnerability in Quicly, an IETF QUIC protocol implementation used primarily within the H2O HTTP server. The library's packet decoder accepts Connection IDs of up to 255 bytes while its CID buffers are limited to 20 bytes, and the library itself lacks enforcement to reject QUIC version 1 packets with Connection IDs exceeding 20 bytes. When applications using the library do not implement their own enforcement, a remote unauthenticated attacker can cause connection state corruption and assertion failures via a specially crafted packet. Affected versions: - commits up to 53fab82 We recommend updating to: commit 8b178e6 and above. CVSS 7.5 · our assessment: this_week Vendor advisory: https://github.com/h2o/quicly/security/advisories/GHSA-v55w-59qx-2v78 Details: https://vuln.today/cve/CVE-2026-44436