What is the CVSS score of CVE-2026-44435?

CVE-2026-44435 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of quicly are affected by CVE-2026-44435?

H2O web servers using quicly for QUIC protocol handling are subject to unauthenticated remote denial-of-service attacks that can crash the server process, directly threatening service uptime.

How to fix or mitigate CVE-2026-44435?

Within 24 hours, inventory all H2O HTTP server instances and identify which builds run quicly versions prior to commit 937d0e9. Within 7 days, implement interim network mitigations: restrict QUIC traffic (UDP port 443) to trusted sources via firewall rules, enable rate limiting on CRYPTO stream handshakes if available in the HTTP server configuration, and configure network IDS signatures to alert on oversized QUIC CRYPTO frames (>32KB per stream). Within 30 days, apply vendor-released patches once available from quicly and H2O maintainers (monitor their official repositories and security advisories), or rebuild systems with code incorporating commit 937d0e9 or later if not yet released in an official patch.

quicly CVE-2026-44435

HIGH

Reachable Assertion (CWE-617)

2026-07-16 GitHub_M

Denial Of Service Quicly H2O

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote, unauthenticated, no interaction over the QUIC handshake with low complexity; impact is solely an assertion-driven crash, so C/I:N and A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 23:20 vuln.today

CVE Published

Jul 16, 2026 - 22:39 cve.org

HIGH 7.5

DescriptionCVE.org

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a Denial of Service. This issue has been fixed by commit 937d0e9.

AnalysisAI

Remote denial of service in quicly, the IETF QUIC implementation used by the H2O HTTP server, allows unauthenticated attackers to crash the process by sending more than 32KB of valid handshake messages over the CRYPTO stream within a single packet number space, tripping a reachable assertion (CWE-617). Affects all builds prior to commit 937d0e9. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the network-reachable, no-privilege nature makes it trivially triggerable once understood.

Technical ContextAI

quicly implements the QUIC transport protocol (RFC 9000/9001), where TLS 1.3 handshake data is carried inside QUIC CRYPTO frames reassembled per packet-number-space CRYPTO stream. The vulnerability is a CWE-617 reachable assertion: the code enforces an internal invariant assuming the cumulative volume of valid handshake messages in one packet number space will not exceed 32KB, and when a peer legitimately (or maliciously) supplies more, the assertion fires and aborts the process rather than gracefully rejecting the oversized input. Per the CPE (cpe:2.3:a:h2o:quicly), this affects the quicly library itself, and by extension any server such as H2O that embeds it to terminate QUIC/HTTP-3 connections.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - update quicly to a build that includes commit 937d0e9e7c669fc2bee4920632ab6aaac60e4d81 (or later) and rebuild/redeploy any H2O or downstream binaries that statically embed it, as described in advisory GHSA-2cw9-5673-73gv (https://github.com/h2o/quicly/security/advisories/GHSA-2cw9-5673-73gv). If you cannot rebuild immediately, reduce exposure by disabling QUIC/HTTP-3 listeners and forcing clients onto HTTP/2 over TCP/TLS, which removes the vulnerable CRYPTO-stream path entirely at the cost of losing HTTP-3; alternatively, restrict UDP/443 QUIC reachability to trusted networks or place rate-limiting/anti-abuse controls in front of the QUIC endpoint, accepting that these only slow rather than eliminate a single crafted connection. Ensure process supervision (systemd/automatic restart) is configured so an assertion abort self-recovers, understanding this masks but does not prevent repeated DoS.