Denial of Service Vulnerability in H2O HTTP Server's Quicly Implementation

CVE-2026-44435

What is CVE-2026-44435?

Quicly, an IETF QUIC protocol implementation for the H2O HTTP server, had a vulnerability wherein an assertion failure could be triggered if more than 32KB of valid handshake messages were received via a CRYPTO stream within a single packet number space. This flaw made the system susceptible to a Denial of Service attack. The issue has since been resolved through a specific code commit. Users are encouraged to update to the latest version to mitigate risk.

References