CVE-2025-61684 Quicly has assertion failures
A remote attacker can trigger assertion failures in the Quicly library, causing a denial of service by crashing the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-61684?
CVE-2025-61684 is a high-severity denial of service vulnerability in h2o quicly, published on 19 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using Quicly. Commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e fixes the issue.
Which versions are affected by CVE-2025-61684?
It affects 1 product.
Products include H2o Quicly.
How do I fix CVE-2025-61684?
No fix has been published for CVE-2025-61684 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-61684 being exploited?
There is no known exploitation of CVE-2025-61684 in the wild and no public exploit code.
Other vulnerabilities in h2o quicly
- CVE-2026-44435 Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB
- CVE-2026-44436 Quicly is vulnerable to connection state corruption
- CVE-2026-44433 Quicly is vulnerable to memory exhaustion
- CVE-2026-44434 Quicly is vulnerable to stateless reset injection
Sources
Also known as GHSA-wr3c-345m-43v9.