CVE-2026-44435: Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB
Vulnerability summary
CVE-2026-44435 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in h2o quicly. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 42% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Timeline
- 16-07-2026PublishedVulnerability first disclosed.
- 17-07-2026Last modifiedVulnerability information updated.
Description
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a Denial of Service. This issue has been fixed by commit 937d0e9.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.49% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
H2o1 product
- quicly< 937d0e9 | < 2026-05-29
1 vendor · 1 product