CVE-2026-94450: Potential denial of service when configured to send Retry packets in s2n-quic
Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected.
To remediate this issue, users should upgrade to version v1.89.0 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
s2n-quicto a version that resolves this vulnerability.Fixed in v1.89.0
Event History
Frequently Asked Questions
Which deployments are affected?
Only s2n-quic server endpoints that are specifically configured to send Retry packets are affected. The issue applies to versions 1.88.0 and earlier.
Does an attacker need credentials or user interaction to trigger the denial of service?
No. An unauthenticated remote attacker can shut down an affected server endpoint using a single crafted UDP datagram.
What should teams do if they use Retry packets?
Upgrade s2n-quic to v1.89.0 or later. If an immediate upgrade is not possible, the provided information identifies Retry-enabled server endpoints as the affected configuration.