CVE-2026-44436

Name of the Vulnerable Software and Affected Versions Quicly versions prior to commit 8b178e6

Description Quicly is vulnerable to a Denial of Service (DoS) attack caused by connection state corruption. While the QUIC version 1 protocol restricts Connection IDs (CID) to 20 bytes, the packet decoder in Quicly accepts CIDs up to 255 bytes to maintain compatibility with unknown QUIC versions. Because the CID buffers are limited to 20 bytes, the library fails to enforce the length restriction for QUIC version 1 packets. This leads to a buffer overrun that causes connection state inconsistency and assertion failures.

Recommendations Update Quicly to commit 8b178e6 or a newer version.