CVE-2026-94450: CWE-1284 Improper validation of specified quantity in input in AWS s2n-quic

This vulnerability (CVE-2026-94450) in AWS s2n-quic arises from improper validation of the Destination Connection ID length in versions up to 1.88.0. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted UDP datagram to a server endpoint configured to send Retry packets, causing a denial of service by shutting down the endpoint. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts availability only. AWS has released version 1.89.0 to remediate this issue.

An unauthenticated remote attacker can cause a denial of service condition on affected server endpoints by sending a single crafted UDP datagram. This results in the shutdown of the server endpoint, impacting availability. There is no impact on confidentiality or integrity. Only server endpoints configured to send Retry packets are vulnerable.

A fix is available. Users should upgrade AWS s2n-quic to version 1.89.0 or later to remediate this vulnerability. Since this is a cloud service component, AWS manages remediation for cloud-hosted services; users should verify their deployments are updated accordingly. No additional mitigation steps are indicated by the vendor advisory.