Quicly
CVE-2026-44433
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated peer over network with no complexity; no confidentiality or integrity impact, only availability exhaustion.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, an adversarial peer could send a STREAM frame carrying just one byte at the largest offset being permitted to obtain additional flow control credit, which under certain circumstances could lead to a Denial of Service. Assuming the application prepares a receive buffer for storing all data that arrive out-of-order, up to the largest offset being received, this behavior could lead to the application allocating large amount of memory with the peer sending only a handful of packets, resulting in memory exhaustion. In addition to the receive buffer allocation strategy, the severity of this vulnerability depends on how the application controls the stream concurrency. In case of the H2O HTTP server, under its default setting, this bug increases the maximum amount of memory allocated per connection by about 4 times. This issue has been fixed by commit 8b178e6.
AnalysisAI
Memory exhaustion in Quicly's QUIC flow control handling allows an unauthenticated remote peer to force disproportionate receive buffer allocation in the H2O HTTP server by sending STREAM frames containing a single byte placed at the maximum permitted stream offset. The library pre-allocates buffers up to the largest received offset to accommodate out-of-order delivery, so a handful of crafted packets can cause the server to allocate memory far exceeding what the transferred data warrants. Under H2O's default stream concurrency settings, this attack multiplies per-connection memory usage by roughly 4x, making memory exhaustion achievable at low bandwidth cost. No public exploit identified at time of analysis; EPSS is 0.25% (16th percentile) and CISA SSVC lists exploitation as 'none', suggesting no observed real-world abuse.
Technical ContextAI
Quicly (CPE: cpe:2.3:a:h2o:quicly:*:*:*:*:*:*:*:*) is an IETF QUIC protocol library written in C, designed primarily for use within the H2O HTTP server. QUIC flow control permits each endpoint to signal how much data it is willing to receive; an attacker exploits this by placing exactly one byte of data at the maximum allowed stream offset, causing the receiver to interpret the full offset range as potentially in-flight out-of-order data. If the application allocates a contiguous receive buffer spanning from byte 0 to the largest received offset - to store reordered segments - this single byte triggers an outsized allocation. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause: no per-connection ceiling on the aggregate memory committed for receive buffers. Stream concurrency further amplifies impact because each concurrent stream independently triggers the same oversized allocation. Notably, the fix commit (8b178e692c51a3b1031612ef89f03a53aac63c15) as visible in the diff primarily adds Connection ID (CID) length validation - rejecting packets whose destination or source CID exceeds QUICLY_MAX_CID_LEN_V1 - and a corresponding test for 255-byte SCID payloads; this may indicate the commit addresses multiple DoS vectors, with the STREAM-frame flow control issue described in the advisory and the CID length overflow fixed together.
RemediationAI
The upstream fix is available at commit 8b178e692c51a3b1031612ef89f03a53aac63c15 in the h2o/quicly repository (https://github.com/h2o/quicly/commit/8b178e692c51a3b1031612ef89f03a53aac63c15). Operators should update Quicly to a build incorporating this commit or any subsequent tagged release that includes it. Because Quicly is typically embedded within H2O rather than distributed as a standalone package, operators should rebuild H2O from source against the patched Quicly tree or await an H2O distribution update. As a compensating control pending patching, reducing the maximum number of concurrent QUIC streams per connection (via H2O's stream concurrency configuration) will limit the per-connection memory amplification, trading some HTTP-3 throughput for reduced DoS exposure. Disabling HTTP-3/QUIC entirely and falling back to HTTP-2 over TLS eliminates the attack surface entirely but removes QUIC performance benefits. No vendor-released tagged version boundary has been confirmed, so pinning to a specific release number from public package repositories may not be sufficient - verify the embedded Quicly commit hash.
Denial of service in Quicly, the QUIC protocol library embedded in the H2O HTTP server, allows remote attackers to corru
Remote denial of service in quicly, the IETF QUIC implementation used by the H2O HTTP server, allows unauthenticated att
Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a
Quicly is an IETF QUIC protocol implementation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitab
Stateless reset injection in Quicly, the IETF QUIC implementation embedded in the H2O HTTP server, allows an on-path net
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today