CVE-2026-44435

7.5 Élevée

Publiée le 17/07/2026 à 01:16 · Modifiée le 06/08/2026 à 15:46 · Analysée par le NVD · Source : security-advisories@github.com

Description

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a Denial of Service. This issue has been fixed by commit 937d0e9.

Traduire en français

Produits concernés

h2o quicly

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-400
CWE-617

Références

https://github.com/h2o/quicly/commit/937d0e9e7c669fc2bee4920632ab6aaac60e4d81 Patch
https://github.com/h2o/quicly/security/advisories/GHSA-2cw9-5673-73gv Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories