Quicly, an IETF QUIC protocol implementation used in the h2o HTTP server, improperly handles Connection IDs (CIDs) longer than 20 bytes for QUIC version 1 packets. While the QUIC standard limits CIDs to 20 bytes for version 1, quicly's packet decoder accepts up to 255 bytes to accommodate unknown versions. However, its internal CID buffers remain 20 bytes, causing a buffer overflow when longer CIDs are processed without proper rejection. This leads to connection state corruption and assertion failures, resulting in denial of service. The issue was addressed in commit 8b178e6, but no explicit patch or remediation details are provided in the source data.

The vulnerability can cause denial of service due to connection state corruption and assertion failures when processing QUIC version 1 packets with Connection IDs longer than 20 bytes. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue was fixed by commit 8b178e6, so applying this or later commits is recommended once confirmed. Until then, applications using quicly should ensure they enforce Connection ID length restrictions to prevent malformed packets from causing buffer overflows.