CVE-2026-44434 describes a vulnerability in Quicly, an IETF QUIC protocol implementation for the H2O HTTP server. Prior to commit dccf5d4, Quicly did not properly validate which of the four secret pattern slots used for stateless resets contained valid entries. Because these slots were zero-initialized, an all-zero pattern was mistakenly accepted as a valid stateless reset unless the peer advertised all four patterns. This allowed an on-path attacker to inject stateless reset packets and forcibly reset QUIC connections. The vulnerability affects availability but not confidentiality or integrity. The issue has been fixed by the referenced commit.

An attacker with network access could inject stateless reset packets to forcibly terminate QUIC connections managed by Quicly, causing denial of service. There is no impact on confidentiality or integrity of data. The CVSS score of 5.3 reflects a medium severity denial of service vulnerability exploitable remotely without privileges or user interaction.

A fix for this vulnerability was introduced in commit dccf5d4. Since no official patch or vendor advisory is provided here, patch status is not yet confirmed — check the vendor advisory or project repository for the commit and apply the fix accordingly. Until patched, be aware of the potential for connection resets caused by this flaw.