Quicly
CVE-2026-44436
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach QUIC listener over network
-
DeliveryCraft version-1 packet with >20-byte CID
-
ExploitDecoder accepts oversized Connection ID
-
ExecutionCopy overruns 20-byte CID buffer
-
PersistCorrupt connection state, trigger assertion
-
ImpactProcess crash / denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires sending a QUIC version 1 packet whose Connection ID field exceeds the 20-byte version-1 maximum (up to the 255-byte QUIC Invariants limit the decoder accepts) to a service that links the Quicly library directly. The decisive limiting factor is deployment configuration: the target application must lack its own CID-length enforcement - applications or the bundled CLI that already reject over-length version-1 CIDs are not exploitable. No authentication or user interaction is needed against a vulnerable application (PR:N/UI:N), and the impact is limited to a crash/assertion failure rather than memory corruption because the overflow stays within the allocated chunk. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a purely availability impact reachable remotely without authentication or user interaction, consistent with the description of a network-triggered assertion failure. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so the practical exploitation likelihood cannot be quantified from the input. A meaningful caveat tempers the raw 7.5: the vendor states the overflow stops within the allocated memory chunk and results in assertion failures rather than memory corruption or code execution, so the realistic worst case is a process crash/DoS, not RCE. Exploitability also depends on the embedding application - applications that perform their own CID-length enforcement (as the bundled CLI does) are not affected - which narrows real-world exposure below what an unqualified network-vector score implies. |
| Exploit ScenarioDerived | An attacker sends a single crafted QUIC version 1 long-header packet with a Connection ID longer than 20 bytes to a server built on a vulnerable Quicly-linked application. The oversized CID is copied into the undersized buffer, corrupting connection state and firing an assertion failure that crashes the process, denying service to legitimate clients. No authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N); no public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 16, 2026
Denial of service in Quicly, the QUIC protocol library embedded in the H2O HTTP server, allows remote attackers to corrupt connection state and crash the process prior to commit 8b178e6. Quicly's packet decoder accepts Connection IDs up to 255 bytes (permitted for unknown QUIC versions) but its version-1 CID buffers are only 20 bytes, and the library - unlike its bundled CLI - never rejected over-length CIDs, letting an oversized CID overrun the buffer within its allocated chunk and trigger assertion failures. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
RemediationAI
Upstream fix available (commit 8b178e6); a tagged patched release version is not independently confirmed from the provided data - update Quicly to a build that includes commit 8b178e692c51a3b1031612ef89f03a53aac63c15 (https://github.com/h2o/quicly/commit/8b178e692c51a3b1031612ef89f03a53aac63c15) and consult the advisory at https://github.com/h2o/quicly/security/advisories/GHSA-v55w-59qx-2v78 for guidance. Until the library is updated, applications embedding Quicly should add their own enforcement that rejects any QUIC version 1 packet whose Connection ID exceeds 20 bytes before it reaches the vulnerable decode path, mirroring the check already present in the bundled CLI tool; this is low-risk because over-length version-1 CIDs are non-conformant and legitimately droppable. Where feasible, rate-limiting or filtering malformed QUIC handshake packets at the network edge can reduce crash exposure, with the trade-off that stateful UDP/QUIC filtering is harder to apply than TCP and may add latency.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
QUIC (RFC 9000) defines Connection IDs (CIDs) that clients and servers exchange to route packets across changing network paths. The QUIC Invariants (RFC 8999) cap CID length at 255 bytes so implementations can parse packets of unknown future versions, while QUIC version 1 tightens the limit to 20 bytes. Quicly implements only version 1 and sizes its CID buffers to 20 bytes, yet its long-header packet decoder honors the 255-byte invariant maximum so it can still read packets of versions it does not understand. The defect is a classic CWE-120 (Buffer Copy without Checking Size of Input): the library copied a decoded CID of up to 255 bytes into a 20-byte buffer because the version-1 length check present in the bundled command-line tool was never implemented inside the library itself. The affected component is cpe:2.3:a:h2o:quicly (all versions before the fix commit).
Know when Quicly gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated crafted packet with no user interaction yields availability-only impact (assertion/crash), with no confidentiality or integrity effect since the overflow stays within allocated memory.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, Quicly is vulnerable to a Denial of Service attack through connection state corruption. In QUIC Invariants, the maximum length of a Connection ID is 255 bytes, while QUIC version 1 further restricts the maximum to 20 bytes. Quicly implements QUIC version 1 and therefore its CID buffers are limited to 20 bytes. However, to be able to respond to unknown versions of QUIC, its packet decoder accepts Connection IDs of up to 255 bytes. As its CID buffers are merely 20 bytes long, Quicly must reject QUIC version 1 packets with Connection IDs longer than that. The command line tool bundled with Quicly has had that check, however the library itself lacked such enforcement. As a consequence, when used by applications that lack their own enforcement, the connection state becoming inconsistent to buffer overrun. Fortunately, the overflow stops within the allocated chunk of memory, but nevertheless, the bug leads to assertion failures. This issue has been fixed by commit 8b178e6.
Executive ViewAI
H2O HTTP servers using the Quicly QUIC library are vulnerable to remote denial-of-service attacks through malformed connection identifiers that exceed buffer limits and cause process crashes. No vendor patch is currently available, creating immediate availability risk for organizations deploying H2O.
No vendor-released patch identified at time of analysis. Interim mitigations include network-level rate limiting on QUIC handshakes, ingress packet filtering to reject malformed QUIC packets with oversized Connection IDs, and network segmentation to restrict QUIC access to essential systems only. Disable QUIC support if not operationally required. Monitor application logs for crash indicators and assertion failures. Evaluate H2O's bundled CLI component if it provides improved connection identifier validation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Remote denial of service in quicly, the IETF QUIC implementation used by the H2O HTTP server, allows unauthenticated att
Memory exhaustion in Quicly's QUIC flow control handling allows an unauthenticated remote peer to force disproportionate
Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a
Quicly is an IETF QUIC protocol implementation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitab
Stateless reset injection in Quicly, the IETF QUIC implementation embedded in the H2O HTTP server, allows an on-path net
Exploit-DB