CVE-2026-94450

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packet...

EUVD-2026-84822

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packet...

CVE-2026-94450 Potential denial of service when configured to send Retry packets in s2n-quic

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packet...

CVE-2026-94450

The s2n-quic library, version 1.88.0 and earlier , contains a vulnerability where improper validation of the Destination Connection ID length can be exploited. An unauthenticated remote user can trigger a denial of service by shutting down a server endpoint using a single crafted UDP datagram . T...

CVE-2026-94450 Potential denial of service when configured to send Retry packets in s2n-quic

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packet...

CVE-2026-94450 Potential denial of service when configured to send Retry packets in s2n-quic

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packet...

CVE-2026-94450: Improper Validation of Specified Quantity in Input

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packet...

PT-2026-97044

Name of the Vulnerable Software and Affected Versions s2n-quic versions prior to 1.89.0 Description Improper validation of the Destination Connection ID length allows an unauthenticated remote user to cause a denial of service by shutting down a server endpoint using a single crafted UDP datagram...

byterag-core (0.3.0), byterag-ffi (0.3.0) +7 more potentially affected by CVE-2026-10740 via s2n-quic (1.37.0)

s2n-quic CARGO version 1.37.0 is affected by a known vulnerability. The following packages have a transitive dependency on s2n-quic and may be impacted: - byterag-core 0.3.0 - byterag-ffi 0.3.0 - cryprot-net 0.1.0 - dbx-core =0.2.0-beta, =0.2.0-beta, =0.10.0, =0.1.0, =0.1.0, =0.2.2, =0.3.0 Source...

GHSA-9Q54-F358-3FQF s2n-quic has excessive memory allocation

s2n-quic is a Rust implementation of the QUIC protocol. An unauthenticated user can attempt to exhaust server memory on an s2n-quic endpoint by sending crafted CRYPTO frames with high offsets. The buffer used for processing CRYPTO frames does not enforce a maximum size. In the worst case, a singl...

s2n-quic has excessive memory allocation

s2n-quic is a Rust implementation of the QUIC protocol. An unauthenticated user can attempt to exhaust server memory on an s2n-quic endpoint by sending crafted CRYPTO frames with high offsets. The buffer used for processing CRYPTO frames does not enforce a maximum size. In the worst case, a singl...

CVE-2026-10740 Excessive memory allocation in s2n-quic

Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a denial of service degraded availability by sending crafted QUIC Initial packets. To remediate this issue, users should upgrade to v1.8.2...

CVE-2026-10740 Excessive memory allocation in s2n-quic

Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a denial of service degraded availability by sending crafted QUIC Initial packets. To remediate this issue, users should upgrade to v1.8.2...

CVE-2026-10740

CVE-2026-10740 affects s2n-quic prior to version 1.8.2, where an unbounded memory allocation in the CRYPTO frame reassembler can allow an unauthenticated remote actor to trigger a denial of service (degraded availability) by sending crafted QUIC Initial packets. The vulnerability is triggered dur...

s2n-quic 安全漏洞

s2n-quic is a high-performance QUIC protocol implementation library open source by Amazon Web Services. Versions of s2n-quic prior to 1.8.2 contained security vulnerabilities. These vulnerabilities stemmed from unbounded memory allocation in theCRYPTO frame reassembler, which could allow...

CVE-2026-10740: Allocation of Resources Without Limits or Throttling

Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a denial of service degraded availability by sending crafted QUIC Initial packets. To remediate this issue, users should upgrade to v1.8.2...

jwts (>=0.5.0, <=0.5.1), rustls-webpki (>=0.102.6, <=0.102.8) potentially affected by CVE-2026-4428 via aws-lc-sys (0.21.0)

aws-lc-sys CARGO version 0.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on aws-lc-sys and may be impacted: - jwts =0.5.0, =0.102.6, =0.102.8 Source cves: CVE-2026-4428 Source advisory: OSV:GHSA-9F94-5G5W-GF6R...

jwts (>=0.5.0, <=0.5.1), rustls-webpki (>=0.102.6, <=0.102.8) potentially affected by CVE-2026-4428 via aws-lc-sys (0.21.0)

aws-lc-sys CARGO version 0.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on aws-lc-sys and may be impacted: - jwts =0.5.0, =0.102.6, =0.102.8 Source cves: CVE-2026-4428 Source advisory: OSV:RUSTSEC-2026-0048...

jwts (>=0.5.0, <=0.5.1), rustls-webpki (>=0.102.2, <=0.102.8) potentially affected by CVE-2026-3337 via aws-lc-sys (>=0.14.1, <=0.21.0)

aws-lc-sys CARGO version =0.14.1, =0.5.0, =0.102.2, =0.102.8 Source cves: CVE-2026-3337 Source advisory: OSV:GHSA-65P9-R9H6-22VJ...

jwts (>=0.5.0, <=0.5.1), rustls-webpki (>=0.102.2, <=0.102.8) potentially affected by CVE-2026-3337 via aws-lc-sys (>=0.14.1, <=0.21.0)

aws-lc-sys CARGO version =0.14.1, =0.5.0, =0.102.2, =0.102.8 Source cves: CVE-2026-3337 Source advisory: OSV:RUSTSEC-2026-0045...