Search/CVE-2026-44435
● CVE — High

CVE-2026-44435

Vendorh2oProductquiclyDiscoveredJul 16, 2026UpdatedOct 24, 2026

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a Denial of Service. This issue has been fixed by commit 937d0e9.

CVSS v3.1
7.5 HIGH
EPSS
0.49%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Aug 26, 2026
▲ 0.21pp
0.28% → 0.49% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityNONE
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Connections
3 relationships
Timeline
disclosure → media coverage
Jul 16, 2026
Disclosure — published as a CVE record. · last revised by NVD Oct 24, 2026