CVE-2026-94450CWE-1284CWE-617

CVE-2026-94450

High · published September 23, 2026

CVSS v3.1
7.5
EPSS
2%
Percentile
80.0
In the wild
Unconfirmed
What it is

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected.

To remediate this issue, users should upgrade to version v1.89.0 or later.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.01944 · 80.0th percentile
Weaknesses
CWE-1284 · Improper Validation of Specified Quantity in Input; CWE-617 · Reachable Assertion
Published
2026-09-23T01:17Z
References (3)
https://aws.amazon.com/security/security-bulletins/2026-116-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/s2n-quic/releases/tag/v1.89.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/s2n-quic/security/advisories/GHSA-5rw2-6x5m-v22x · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 24 SEP 03:25Z
    EPSS moved — → 2%
    epss
  • 22 SEP 20:04Z
    Potential denial of service when configured to send Retry packets in s2n-quic
    cvelistv5