CVE-2026-44436: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in h2o quicly
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, Quicly is vulnerable to a Denial of Service attack through connection state corruption. In QUIC Invariants, the maximum length of a Connection ID is 255 bytes, while QUIC version 1 further restricts the maximum to 20 bytes. Quicly implements QUIC version 1 and therefore its CID buffers are limited to 20 bytes. However, to be able to respond to unknown versions of QUIC, its packet decoder accepts Connection IDs of up to 255 bytes. As its CID buffers are merely 20 bytes long, Quicly must reject QUIC version 1 packets with Connection IDs longer than that. The command line tool bundled with Quicly has had that check, however the library itself lacked such enforcement. As a consequence, when used by applications that lack their own enforcement, the connection state becoming inconsistent to buffer overrun. Fortunately, the overflow stops within the allocated chunk of memory, but nevertheless, the bug leads to assertion failures. This issue has been fixed by commit 8b178e6.
AI Analysis
Technical Summary
Quicly, an IETF QUIC protocol implementation used in the h2o HTTP server, improperly handles Connection IDs (CIDs) longer than 20 bytes for QUIC version 1 packets. While the QUIC standard limits CIDs to 20 bytes for version 1, quicly's packet decoder accepts up to 255 bytes to accommodate unknown versions. However, its internal CID buffers remain 20 bytes, causing a buffer overflow when longer CIDs are processed without proper rejection. This leads to connection state corruption and assertion failures, resulting in denial of service. The issue was addressed in commit 8b178e6, but no explicit patch or remediation details are provided in the source data.
Potential Impact
The vulnerability can cause denial of service due to connection state corruption and assertion failures when processing QUIC version 1 packets with Connection IDs longer than 20 bytes. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue was fixed by commit 8b178e6, so applying this or later commits is recommended once confirmed. Until then, applications using quicly should ensure they enforce Connection ID length restrictions to prevent malformed packets from causing buffer overflows.
CVE-2026-44436: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in h2o quicly
Description
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, Quicly is vulnerable to a Denial of Service attack through connection state corruption. In QUIC Invariants, the maximum length of a Connection ID is 255 bytes, while QUIC version 1 further restricts the maximum to 20 bytes. Quicly implements QUIC version 1 and therefore its CID buffers are limited to 20 bytes. However, to be able to respond to unknown versions of QUIC, its packet decoder accepts Connection IDs of up to 255 bytes. As its CID buffers are merely 20 bytes long, Quicly must reject QUIC version 1 packets with Connection IDs longer than that. The command line tool bundled with Quicly has had that check, however the library itself lacked such enforcement. As a consequence, when used by applications that lack their own enforcement, the connection state becoming inconsistent to buffer overrun. Fortunately, the overflow stops within the allocated chunk of memory, but nevertheless, the bug leads to assertion failures. This issue has been fixed by commit 8b178e6.
CVSS v3.1
Score 7.5high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Quicly, an IETF QUIC protocol implementation used in the h2o HTTP server, improperly handles Connection IDs (CIDs) longer than 20 bytes for QUIC version 1 packets. While the QUIC standard limits CIDs to 20 bytes for version 1, quicly's packet decoder accepts up to 255 bytes to accommodate unknown versions. However, its internal CID buffers remain 20 bytes, causing a buffer overflow when longer CIDs are processed without proper rejection. This leads to connection state corruption and assertion failures, resulting in denial of service. The issue was addressed in commit 8b178e6, but no explicit patch or remediation details are provided in the source data.
Potential Impact
The vulnerability can cause denial of service due to connection state corruption and assertion failures when processing QUIC version 1 packets with Connection IDs longer than 20 bytes. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue was fixed by commit 8b178e6, so applying this or later commits is recommended once confirmed. Until then, applications using quicly should ensure they enforce Connection ID length restrictions to prevent malformed packets from causing buffer overflows.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-06T14:40:00.954Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a59635868715ace43da39d6
Added to database: 07/16/2026, 23:03:52 UTC
Last enriched: 07/16/2026, 23:17:28 UTC
Last updated: 08/31/2026, 01:33:24 UTC
Views: 86
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.