CVE Explorer

CVE-2026-44435

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a Denial of Service. This issue has been fixed by commit 937d0e9.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:80669b741516f1d3eb3e8af7722bcb9b11bb58967f77f68da9344b6830224528

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-400","description":"CWE-400: Uncontrolled Resource Consumption","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:55069f728064e9a97fb74ab61dc9d4df8002820440032e139d02cd9f22f871ee · sha256:6a23a2c7b3d171f7… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-617","description":"CWE-617: Reachable Assertion","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:55069f728064e9a97fb74ab61dc9d4df8002820440032e139d02cd9f22f871ee · sha256:6a23a2c7b3d171f7… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion

{"product":"quicly","vendor":"h2o","versions":[{"status":"affected","version":"< 937d0e9"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:55069f728064e9a97fb74ab61dc9d4df8002820440032e139d02cd9f22f871ee · sha256:6a23a2c7b3d171f7… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:55069f728064e9a97fb74ab61dc9d4df8002820440032e139d02cd9f22f871ee · sha256:6a23a2c7b3d171f7… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions

{"cweId":"CWE-400","description":"CWE-400: Uncontrolled Resource Consumption","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:55069f728064e9a97fb74ab61dc9d4df8002820440032e139d02cd9f22f871ee · sha256:6a23a2c7b3d171f7… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-617","description":"CWE-617: Reachable Assertion","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:55069f728064e9a97fb74ab61dc9d4df8002820440032e139d02cd9f22f871ee · sha256:6a23a2c7b3d171f7… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"name":"https://github.com/h2o/quicly/commit/937d0e9e7c669fc2bee4920632ab6aaac60e4d81","tags":["x_refsource_MISC"],"url":"https://github.com/h2o/quicly/commit/937d0e9e7c669fc2bee4920632ab6aaac60e4d81"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55069f728064e9a97fb74ab61dc9d4df8002820440032e139d02cd9f22f871ee · sha256:6a23a2c7b3d171f7… · /containers/cna/references/1

{"name":"https://github.com/h2o/quicly/security/advisories/GHSA-2cw9-5673-73gv","tags":["x_refsource_CONFIRM"],"url":"https://github.com/h2o/quicly/security/advisories/GHSA-2cw9-5673-73gv"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:55069f728064e9a97fb74ab61dc9d4df8002820440032e139d02cd9f22f871ee · sha256:6a23a2c7b3d171f7… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer