CVE-2026-44435CWE-400CWE-617denial-of-service

CVE-2026-44435

High · published July 17, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
41.1
In the wild
Unconfirmed
What it is

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a Denial of Service. This issue has been fixed by commit 937d0e9.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00488 · 41.1th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-617 · Reachable Assertion
Published
2026-07-17T03:16Z
Affected products (1)
ProductVersionsFixed in
h2o/quicly< 2026-05-292026-05-29
References (2)
https://github.com/h2o/quicly/commit/937d0e9e7c669fc2bee4920632ab6aaac60e4d81 · [email protected]https://github.com/h2o/quicly/security/advisories/GHSA-2cw9-5673-73gv · [email protected]
EPSS history
Timeline
  • 16 JUL 22:39Z
    Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB
    cvelistv5