High severity7.5NVD Advisory· Published Sep 22, 2026· Updated Oct 20, 2026

CVE-2026-94450

Description

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected.

To remediate this issue, users should upgrade to version v1.89.0 or later.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

AWS/S2n Quicllm-fuzzy
Range: <=1.88.0

Patches

Vulnerability mechanics

References

aws.amazon.com/security/security-bulletins/2026-116-aws/nvd
github.com/aws/s2n-quic/releases/tag/v1.89.0nvd
github.com/aws/s2n-quic/security/advisories/GHSA-5rw2-6x5m-v22xnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.002
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000