CVE-2026-44434 describes a vulnerability in Quicly, an IETF QUIC protocol implementation used primarily in the H2O HTTP server. Prior to commit dccf5d4, Quicly did not properly verify which of the four secret pattern slots used for stateless resets contained valid entries. Because these slots were zero-initialized, an all-zero pattern was mistakenly accepted as a valid stateless reset unless the peer advertised all four patterns. This allowed an on-path attacker to inject stateless reset packets and forcibly reset QUIC connections. The vulnerability affects availability but not confidentiality or integrity. The issue has been fixed by the referenced commit.

An attacker positioned on the network path can inject stateless reset packets to forcibly terminate QUIC connections managed by Quicly. This results in denial of service by disrupting ongoing connections. There is no impact on data confidentiality or integrity.

The vulnerability has been fixed by commit dccf5d4. No official patch or vendor advisory is provided in the data, and the remediation level is not specified. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, users should consider the risk of on-path attackers causing connection resets.