Stateless Reset Injection Vulnerability in Quicly Implementation for H2O HTTP Server

CVE-2026-44434

What is CVE-2026-44434?

Quicly, an implementation of the IETF QUIC protocol used primarily in the H2O HTTP server, was found to have a vulnerability that allowed stateless reset injection due to inadequate packet entry validation. This flaw arises from the handling of slots used to store secret patterns for QUIC connections. The implementation was unable to validate which of the up to four slots contained a legitimate secret pattern, resulting in the all-zero pattern being misinterpreted as a valid stateless reset. Consequently, this vulnerability created an opportunity for on-path attackers to reset QUIC connections, which has been addressed in subsequent commits.

References