High severity7.5NVD Advisory· Published Jul 16, 2026· Updated Aug 6, 2026

CVE-2026-44435

Description

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a Denial of Service. This issue has been fixed by commit 937d0e9.

Affected products

H2o/Quiclyllm-fuzzy
Range: <=commit 937d0e9

Patches

Vulnerability mechanics

References

github.com/h2o/quicly/commit/937d0e9e7c669fc2bee4920632ab6aaac60e4d81nvdPatch
github.com/h2o/quicly/security/advisories/GHSA-2cw9-5673-73gvnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000