Quicly
Monthly
Denial of service in Quicly, the QUIC protocol library embedded in the H2O HTTP server, allows remote attackers to corrupt connection state and crash the process prior to commit 8b178e6. Quicly's packet decoder accepts Connection IDs up to 255 bytes (permitted for unknown QUIC versions) but its version-1 CID buffers are only 20 bytes, and the library - unlike its bundled CLI - never rejected over-length CIDs, letting an oversized CID overrun the buffer within its allocated chunk and trigger assertion failures. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote denial of service in quicly, the IETF QUIC implementation used by the H2O HTTP server, allows unauthenticated attackers to crash the process by sending more than 32KB of valid handshake messages over the CRYPTO stream within a single packet number space, tripping a reachable assertion (CWE-617). Affects all builds prior to commit 937d0e9. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the network-reachable, no-privilege nature makes it trivially triggerable once understood.
Memory exhaustion in Quicly's QUIC flow control handling allows an unauthenticated remote peer to force disproportionate receive buffer allocation in the H2O HTTP server by sending STREAM frames containing a single byte placed at the maximum permitted stream offset. The library pre-allocates buffers up to the largest received offset to accommodate out-of-order delivery, so a handful of crafted packets can cause the server to allocate memory far exceeding what the transferred data warrants. Under H2O's default stream concurrency settings, this attack multiplies per-connection memory usage by roughly 4x, making memory exhaustion achievable at low bandwidth cost. No public exploit identified at time of analysis; EPSS is 0.25% (16th percentile) and CISA SSVC lists exploitation as 'none', suggesting no observed real-world abuse.
Stateless reset injection in Quicly, the IETF QUIC implementation embedded in the H2O HTTP server, allows an on-path network attacker to abruptly terminate any active QUIC connection by sending an all-zero packet. The root cause is that Quicly zero-initializes its four stateless reset token slots but never validates which slots hold legitimate peer-advertised tokens, causing the all-zero default to be accepted as a valid reset signal whenever the peer has advertised fewer than four tokens. No public exploit code or active exploitation has been identified at time of analysis; however, the attack is mechanically straightforward for any adversary already positioned on the network path.
Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using Quicly. [CVSS 7.5 HIGH]
Quicly is an IETF QUIC protocol implementation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Denial of service in Quicly, the QUIC protocol library embedded in the H2O HTTP server, allows remote attackers to corrupt connection state and crash the process prior to commit 8b178e6. Quicly's packet decoder accepts Connection IDs up to 255 bytes (permitted for unknown QUIC versions) but its version-1 CID buffers are only 20 bytes, and the library - unlike its bundled CLI - never rejected over-length CIDs, letting an oversized CID overrun the buffer within its allocated chunk and trigger assertion failures. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote denial of service in quicly, the IETF QUIC implementation used by the H2O HTTP server, allows unauthenticated attackers to crash the process by sending more than 32KB of valid handshake messages over the CRYPTO stream within a single packet number space, tripping a reachable assertion (CWE-617). Affects all builds prior to commit 937d0e9. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the network-reachable, no-privilege nature makes it trivially triggerable once understood.
Memory exhaustion in Quicly's QUIC flow control handling allows an unauthenticated remote peer to force disproportionate receive buffer allocation in the H2O HTTP server by sending STREAM frames containing a single byte placed at the maximum permitted stream offset. The library pre-allocates buffers up to the largest received offset to accommodate out-of-order delivery, so a handful of crafted packets can cause the server to allocate memory far exceeding what the transferred data warrants. Under H2O's default stream concurrency settings, this attack multiplies per-connection memory usage by roughly 4x, making memory exhaustion achievable at low bandwidth cost. No public exploit identified at time of analysis; EPSS is 0.25% (16th percentile) and CISA SSVC lists exploitation as 'none', suggesting no observed real-world abuse.
Stateless reset injection in Quicly, the IETF QUIC implementation embedded in the H2O HTTP server, allows an on-path network attacker to abruptly terminate any active QUIC connection by sending an all-zero packet. The root cause is that Quicly zero-initializes its four stateless reset token slots but never validates which slots hold legitimate peer-advertised tokens, causing the all-zero default to be accepted as a valid reset signal whenever the peer has advertised fewer than four tokens. No public exploit code or active exploitation has been identified at time of analysis; however, the attack is mechanically straightforward for any adversary already positioned on the network path.
Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using Quicly. [CVSS 7.5 HIGH]
Quicly is an IETF QUIC protocol implementation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.