CVE-2026-44435 | Quicly is an IETF QUIC protocol implementation intended prim… | CVSS 7.5 HIGH

Description

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a Denial of Service. This issue has been fixed by commit 937d0e9.

Metadata

CVE ID: CVE-2026-44435
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-06 14:40 UTC
Published: 2026-07-16 22:39 UTC
Last updated: 2026-07-16 22:39 UTC
Primary CWE: CWE-617
CWE-617: Reachable Assertion
Vendor / Product: h2o / quicly
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products (1)

Vendor	Product	Platform	Versions
h2o	quicly	—	< 937d0e9

Weakness (CWE)

CWE	Source	Description
CWE-400	cna	CWE-400: Uncontrolled Resource Consumption
CWE-617	cna	CWE-617: Reachable Assertion

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (2)

https://github.com/h2o/quicly/security/advisories/GHSA-2cw9-5673-73gv https://github.com/h2o/quicly/security/advisories/GHSA-2cw9-5673-73gv
https://github.com/h2o/quicly/commit/937d0e9e7c669fc2bee4920632ab6aaac60e4d81 https://github.com/h2o/quicly/commit/937d0e9e7c669fc2bee4920632ab6aaac60e4d81