Threats affecting pkg:cargo/aws/s2n-quic

CVE-2026-94450 is a denial of service vulnerability in s2n-quic, a Rust implementation of the QUIC protocol. The flaw occurs due to improper validation of the Destination Connection ID length when a server is configured to send Retry packets. An unauthenticated attacker can exploit this by sending a crafted UDP datagram to shut down the vulnerable server endpoint. This affects s2n-quic versions up to and including 1.88.0. AWS services are not impacted, and only server endpoints configured to issue Retry packets are vulnerable. The vulnerability is fixed in version 1.89.0. No workaround exists, so upgrading is required.