CVE-2026-44436 - Quicly Vulnerability Exposed

CVE-2026-44436 - Quicly Vulnerability 🚨

CVE-2026-44436 reveals that Quicly is vulnerable to connection state corruption. This vulnerability has a HIGH CVSS 3.1 score of 7.5. Quicly is an IETF QUIC protocol implementation primarily used within the H2O HTTP server.

Details

Prior to commit 8b178e6, Quicly was susceptible to a Denial of Service attack caused by connection state corruption. The vulnerability affects the H2O Quicly product.

While the QUIC protocol limits Connection IDs to 255 bytes (and version 1 to 20 bytes), Quicly’s packet decoder for unknown QUIC versions accepted Connection IDs up to 255 bytes, despite its internal CID buffers being only 20 bytes long. Consequently, if applications using the Quicly library did not enforce this length restriction, an overflow could occur within the allocated memory chunk, leading to an inconsistent connection state and assertion failures. This issue has since been resolved by commit 8b178e6.

Severity

CVE-2026-44436 has a CVSS 3.1 score of 7.5, categorized as HIGH severity, with an exploitability score of 3.9 and an impact score of 3.6.

Associated Weaknesses

This vulnerability is associated with several common weakness enumerations:

• CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)
• CWE-787: Out-of-bounds Write

Attack Patterns

Associated attack patterns include:

• CAPEC-8: Buffer Overflow in an API Call
• CAPEC-9: Buffer Overflow in Local Command-Line Utilities
• CAPEC-10: Buffer Overflow via Environment Variables
• CAPEC-14: Client-side Injection-induced Buffer Overflow

Mitigation

To mitigate this vulnerability, users should update Quicly to commit 8b178e6 or a later version. Additionally, applications utilizing Quicly must ensure they validate Connection ID lengths. Applying necessary patches to the H2O HTTP server is also recommended.

For more details, Read full article