Quicly CVE-2026-44434

The attacker must occupy an on-path (man-in-the-middle) network position capable of injecting UDP packets between the Quicly client and server - this is the primary prerequisite and the most significant limiting factor. The vulnerability is triggered when the remote peer has advertised fewer than four stateless reset tokens, leaving one or more zero-initialized slots, which is the common case since advertising all four is not a typical peer behavior. No authentication, special configuration option, or non-default feature flag is required beyond the H2O server having QUIC/HTTP3 support active (i.e., listening on a UDP port). Exploitation is not possible from a purely off-path position because the injected packet must reach the target endpoint before the legitimate peer's next packet resets the protocol state machine.

The NVD-assigned CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) overstates accessibility by labeling attack complexity Low, because the attack fundamentally requires on-path network positioning - a meaningfully elevated prerequisite not reflected in AC:L. A more precise independent assessment would assign AC:H or express the on-path requirement via CVSS 4.0's AT:P. Real-world impact is limited to availability: connections can be forcibly reset, but no confidentiality or integrity loss results. No EPSS data was provided; the vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, both indicators of low-to-moderate real-world exploitation pressure. The primary risk scenario is targeted disruption of QUIC sessions (e.g., persistent HTTP/3 streams) rather than broad opportunistic exploitation, because the adversary must be between the two communicating endpoints. Organizations using H2O with QUIC/HTTP3 enabled on networks where on-path adversaries are plausible (ISP infrastructure, shared cloud egress, zero-trust gaps) carry higher realistic risk than the base CVSS score alone suggests.

An attacker with on-path access between a client and an H2O server - for example, a malicious ISP node, a compromised router, or a network tap - monitors QUIC traffic to identify active connections governed by Quicly. The attacker crafts and injects a UDP packet containing an all-zero stateless reset token; because Quicly treats uninitialised token slots as valid, the receiving endpoint accepts the forged reset and immediately terminates the connection. No public proof-of-concept has been identified, but the attack is mechanically simple once network positioning is achieved.