Vulnerability · Published Sep 22, 2026 · Assigned by AMZN

CVE-2026-94450Potential denial of service when configured to send Retry packets in s2n-quic

High 7.5

In plain English

A high-severity security flaw in s2n-quic from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.9%top 19.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected. To remediate this issue, users should upgrade to version v1.89.0 or later.

Affected products (as reported)

Vendor	Product	Versions
AWS	s2n-quic	0 – through 1.88.0

Weakness: CWE-1284, CWE-617 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/aws/s2n-quic/releases/tag/v1.89.0 patch, release-notes
https://aws.amazon.com/security/security-bulletins/2026-116-aws/ vendor-advisory
https://github.com/aws/s2n-quic/security/advisories/GHSA-5rw2-6x5m-v22x release-notes