CVE-2026-44436 Quicly is vulnerable to connection state corruption

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, Quicly is vulnerable to a Denial of Service attack through connection state corruption. In QUIC Invariants, the maximum length of a Connection ID is 255 bytes, while QUIC...

PT-2026-60602

Name of the Vulnerable Software and Affected Versions Quicly versions prior to commit 8b178e6 Description Quicly is vulnerable to a Denial of Service DoS attack caused by connection state corruption. While the QUIC version 1 protocol restricts Connection IDs CID to 20 bytes, the packet decoder in...