Vulnerability · Published Jul 16, 2026 · Assigned by GitHub_M

CVE-2026-44435Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB

High 7.5

In plain English

A high-severity uncontrolled resource consumption in quicly from h2o. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 57.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a Denial of Service. This issue has been fixed by commit 937d0e9.

Affected products (as reported)

Vendor	Product	Versions
h2o	quicly	< 937d0e9

Weakness: CWE-617, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/h2o/quicly/security/advisories/GHSA-2cw9-5673-73gv x_refsource_CONFIRM
https://github.com/h2o/quicly/commit/937d0e9e7c669fc2bee4920632ab6aaac60e4d81 x_refsource_MISC