What is the CVSS score of CVE-2026-44436?

CVE-2026-44436 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Quicly are affected by CVE-2026-44436?

H2O HTTP servers using the Quicly QUIC library are vulnerable to remote denial-of-service attacks through malformed connection identifiers that exceed buffer limits and cause process crashes.

How to fix or mitigate CVE-2026-44436?

Within 24 hours, identify all systems running H2O with QUIC enabled and configure monitoring for unexpected application crashes with alerting to security operations. Within 7 days, implement network-level mitigations including rate limiting on QUIC connection attempts and packet filtering to reject packets with oversized Connection IDs; evaluate whether H2O's bundled CLI implementation provides adequate connection identifier validation. Within 30 days, establish continuous monitoring of Quicly and H2O repositories for official security patches and develop a rapid-deployment process; consider disabling QUIC protocol support if not operationally critical.

Quicly CVE-2026-44436

HIGH

Classic Buffer Overflow (CWE-120)

2026-07-16 GitHub_M

Buffer Overflow Denial Of Service Quicly H2O

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated crafted packet with no user interaction yields availability-only impact (assertion/crash), with no confidentiality or integrity effect since the overflow stays within allocated memory.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 23:20 vuln.today

CVE Published

Jul 16, 2026 - 22:44 cve.org

HIGH 7.5

DescriptionCVE.org

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, Quicly is vulnerable to a Denial of Service attack through connection state corruption. In QUIC Invariants, the maximum length of a Connection ID is 255 bytes, while QUIC version 1 further restricts the maximum to 20 bytes. Quicly implements QUIC version 1 and therefore its CID buffers are limited to 20 bytes. However, to be able to respond to unknown versions of QUIC, its packet decoder accepts Connection IDs of up to 255 bytes. As its CID buffers are merely 20 bytes long, Quicly must reject QUIC version 1 packets with Connection IDs longer than that. The command line tool bundled with Quicly has had that check, however the library itself lacked such enforcement. As a consequence, when used by applications that lack their own enforcement, the connection state becoming inconsistent to buffer overrun. Fortunately, the overflow stops within the allocated chunk of memory, but nevertheless, the bug leads to assertion failures. This issue has been fixed by commit 8b178e6.

AnalysisAI

Denial of service in Quicly, the QUIC protocol library embedded in the H2O HTTP server, allows remote attackers to corrupt connection state and crash the process prior to commit 8b178e6. Quicly's packet decoder accepts Connection IDs up to 255 bytes (permitted for unknown QUIC versions) but its version-1 CID buffers are only 20 bytes, and the library - unlike its bundled CLI - never rejected over-length CIDs, letting an oversized CID overrun the buffer within its allocated chunk and trigger assertion failures. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

QUIC (RFC 9000) defines Connection IDs (CIDs) that clients and servers exchange to route packets across changing network paths. The QUIC Invariants (RFC 8999) cap CID length at 255 bytes so implementations can parse packets of unknown future versions, while QUIC version 1 tightens the limit to 20 bytes. Quicly implements only version 1 and sizes its CID buffers to 20 bytes, yet its long-header packet decoder honors the 255-byte invariant maximum so it can still read packets of versions it does not understand. The defect is a classic CWE-120 (Buffer Copy without Checking Size of Input): the library copied a decoded CID of up to 255 bytes into a 20-byte buffer because the version-1 length check present in the bundled command-line tool was never implemented inside the library itself. The affected component is cpe:2.3:a:h2o:quicly (all versions before the fix commit).

RemediationAI

Upstream fix available (commit 8b178e6); a tagged patched release version is not independently confirmed from the provided data - update Quicly to a build that includes commit 8b178e692c51a3b1031612ef89f03a53aac63c15 (https://github.com/h2o/quicly/commit/8b178e692c51a3b1031612ef89f03a53aac63c15) and consult the advisory at https://github.com/h2o/quicly/security/advisories/GHSA-v55w-59qx-2v78 for guidance. Until the library is updated, applications embedding Quicly should add their own enforcement that rejects any QUIC version 1 packet whose Connection ID exceeds 20 bytes before it reaches the vulnerable decode path, mirroring the check already present in the bundled CLI tool; this is low-risk because over-length version-1 CIDs are non-conformant and legitimately droppable. Where feasible, rate-limiting or filtering malformed QUIC handshake packets at the network edge can reduce crash exposure, with the trade-off that stateful UDP/QUIC filtering is harder to apply than TCP and may add latency.