TI-2024-30445 Aliases CVE-2024-45396

Quicly assertion failures

MEDIUM 40CWE-617Published 2024-10-11 · Updated 2024-10-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-617.

Summary

Quicly is an IETF QUIC protocol implementation. Quicly up to commtit d720707 is susceptible to a denial-of-service attack. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using quicly. The vulnerability is addressed with commit 2a95896104901589c495bc41460262e64ffcad5c.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00585 48th percentileScored 2026-11-07

Fix Fixed quicly (h2o): 2a95896104901589c495bc41460262e64ffcad5c

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
h2oai	quicly	before 2a95896104901589c495bc41460262e64ffcad5c	2a95896104901589c495bc41460262e64ffcad5c	Patch available	CNA

quicly Vendorh2oai Affected before 2a95896104901589c495bc41460262e64ffcad5c Fixed in 2a95896104901589c495bc41460262e64ffcad5c Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:dena:quicly::::::::	before 2024-10-10	Vulnerable	Kazuho Oku

cpe:2.3:a:dena:quicly:*:*:*:*:*:*:*:* Versions before 2024-10-10 Vulnerable ·Kazuho Oku

Remediation

Fix · CNA quicly (h2o) Fixed in 2a95896104901589c495bc41460262e64ffcad5c

Timeline

2026-10-02 Threatist record created from CVE-2024-45396

References

Patch 1

https://github.com/h2o/quicly/commit/2a95896104901589c495bc41460262e64ffcad5c

Advisory 1

https://github.com/h2o/quicly/security/advisories/GHSA-mp3c-h5gg-mm6p

TI-2025-05944 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
TI-2025-05102 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
TI-2024-09776 Jdbc Deserialization in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
TI-2026-46834 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API CVSS 4.0CRITICAL 9.3
TI-2024-30727 H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to… CVSS 3.1CRITICAL 9.1
TI-2026-03424 Remote Code Execution in h2oai/h2o-3 CVSS 3.1CRITICAL 9.8

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences