CVE-2026-44435: Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a Denial of Service. This issue has been fixed by commit 937d0e9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 937d0e9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44435?
The severity of CVE-2026-44435 is rated high with a score of 7.5.
What type of vulnerability is CVE-2026-44435?
CVE-2026-44435 is a remote denial of service vulnerability.
How does CVE-2026-44435 affect software?
CVE-2026-44435 can cause a denial of service in Quicly when the handshake data exceeds 32KB.
How can I mitigate CVE-2026-44435?
To mitigate CVE-2026-44435, update to the latest version of Quicly which addresses the assertion failure.
What software is impacted by CVE-2026-44435?
CVE-2026-44435 specifically impacts the Quicly implementation of the IETF QUIC protocol.