EUVD-2026-84822Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated single-datagram network DoS (AV:N/AC:L/PR:N/UI:N); the Retry-config prerequisite is a deployment gate not modeled in base metrics; availability-only impact (A:H, C/I:N).
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
7DescriptionCVE.org
Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected.
To remediate this issue, users should upgrade to version v1.89.0 or later.
AnalysisAI
Denial of service in AWS s2n-quic 1.88.0 and earlier allows an unauthenticated remote attacker to shut down a QUIC server endpoint by sending a single crafted UDP datagram that carries a Destination Connection ID of invalid length, which the library fails to validate properly. The impact is limited to server endpoints specifically configured to send QUIC Retry packets (servers that never emit Retry packets are not affected), and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a full availability loss with no confidentiality or integrity impact and no authentication or user interaction required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable only against s2n-quic server endpoints (version ≤1.88.0) that are specifically configured to send QUIC Retry packets - servers not using Retry are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to a genuine but narrowly-scoped availability issue rather than a top-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to s2n-quic v1.89.0 or later, which is the vendor-released fix referenced at https://github.com/aws/s2n-quic/releases/tag/v1.89.0; the same guidance is published in AWS security bulletin 2026-116-aws (https://aws.amazon.com/security/security-bulletins/2026-116-aws/) and advisory GHSA-5rw2-6x5m-v22x. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all AWS s2n-quic deployments and dependencies to identify instances running v1.88.0 or earlier, prioritizing internet-facing QUIC servers configured to emit Retry packets, and confirm whether those endpoints are exposed to untrusted UDP traffic. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in the aws-smithy-json Rust runtime crate (versions before 0.62.7) lets remote unauthenticated attacke
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today