Skip to content
Sign in
7.5 High

CVE-2026-94450 Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an…

Description

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected. To remediate this issue, users should upgrade to version v1.89.0 or later.

Affected products and versions

Product Affected versions Fixed in
s2n-quic 1.88 earliest → 1.88.0 No fix stated

Other CVEs of s2n-quic

The 2 CVEs of s2n-quic →
CVE-2026-10740 Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote… 5.3 Medium
Track this CVE