CVE-2026-44436 Quicly is vulnerable to connection state corruption
Attackers can cause denial of service in applications using Quicly by sending oversized Connection IDs, leading to buffer overruns and assertion failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44436?
CVE-2026-44436 is a high-severity memory corruption vulnerability in h2o quicly, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, Quicly is vulnerable to a Denial of Service attack through connection state corruption. In QUIC Invariants, the maximum length of a Connection ID is 255 bytes, while QUIC version 1 further restricts the maximum to 20 bytes. Quicly implements QUIC version 1 and therefore its CID buffers are limited to 20 bytes. However, to be able to respond to unknown versions of QUIC, its packet decoder accepts Connection IDs of up to 255 bytes. As its CID buffers are merely 20 bytes long, Quicly must reject QUIC version 1 packets with Connection IDs longer than that. The command line tool bundled with Quicly has had that check, however the library itself lacked such enforcement. As a consequence, when used by applications that lack their own enforcement, the connection state becoming inconsistent to buffer overrun. Fortunately, the overflow stops within the allocated chunk of memory, but nevertheless, the bug leads to assertion failures. This issue has been fixed by commit 8b178e6.
Which versions are affected by CVE-2026-44436?
It affects 1 product.
Products include H2o Quicly.
How do I fix CVE-2026-44436?
No fix has been published for CVE-2026-44436 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-44436 being exploited?
There is no known exploitation of CVE-2026-44436 in the wild and no public exploit code.
Other vulnerabilities in h2o quicly
Sources
Also known as GHSA-v55w-59qx-2v78.