TI-2026-32376 Aliases CVE-2026-44435

Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB

LOW 39CWE-400Published 2026-07-16 · Updated 2026-07-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a Denial of Service. This issue has been fixed by commit 937d0e9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00488 42nd percentileScored 2026-11-07

Fix Fixed quicly (h2o): 937d0e9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
h2oai	quicly	before 937d0e9	937d0e9	Patch available	CNA

quicly Vendorh2oai Affected before 937d0e9 Fixed in 937d0e9 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:h2o:quicly::::::::	before 2026-05-29	Vulnerable	h2oai

cpe:2.3:a:h2o:quicly:*:*:*:*:*:*:*:* Versions before 2026-05-29 Vulnerable ·h2oai

Remediation

Fix · CNA quicly (h2o) Fixed in 937d0e9

Timeline

2026-10-02 Threatist record created from CVE-2026-44435

References

Patch 1

https://github.com/h2o/quicly/commit/937d0e9e7c669fc2bee4920632ab6aaac60e4d81

Advisory 1

https://github.com/h2o/quicly/security/advisories/GHSA-2cw9-5673-73gv

TI-2026-32377 Quicly is vulnerable to connection state corruption CVSS 3.1HIGH 7.5
TI-2026-32374 Quicly is vulnerable to memory exhaustion CVSS 3.1HIGH 7.5
TI-2025-38115 Quicly has assertion failures CVSS 3.1HIGH 7.5
TI-2026-32375 Quicly is vulnerable to stateless reset injection CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences