Vulnerability · Published Jul 16, 2026 · Assigned by GitHub_M
CVE-2026-44433Quicly is vulnerable to memory exhaustion
Medium 5.3
In plain English
A medium-severity resource allocation without limits in quicly from h2o. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, an adversarial peer could send a STREAM frame carrying just one byte at the largest offset being permitted to obtain additional flow control credit, which under certain circumstances could lead to a Denial of Service. Assuming the application prepares a receive buffer for storing all data that arrive out-of-order, up to the largest offset being received, this behavior could lead to the application allocating large amount of memory with the peer sending only a handful of packets, resulting in memory exhaustion. In addition to the receive buffer allocation strategy, the severity of this vulnerability depends on how the application controls the stream concurrency. In case of the H2O HTTP server, under its default setting, this bug increases the maximum amount of memory allocated per connection by about 4 times. This issue has been fixed by commit 8b178e6.
Affected products (as reported)
Weakness: CWE-770, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/h2o/quicly/security/advisories/GHSA-f7qr-4p37-9gx9 x_refsource_CONFIRM
- https://github.com/h2o/quicly/commit/8b178e692c51a3b1031612ef89f03a53aac63c15 x_refsource_MISC