# CVE-2026-10740: AWS s2n-quic unbounded memory allocation in CRYPTO frame reassembler

Source: https://junglewise.ai/threats/cve-2026-10740-aws-s2n-quic-unbounded-memory-allocation-in-crypto-frame  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-10740 · Severity: high · CVSS 5.3 · Published 2026-06-10

AWS s2n-quic is a QUIC protocol implementation used in AWS services and customer applications. An excessive memory allocation vulnerability could allow an attacker to consume memory resources on systems running the library, potentially causing denial of service and service unavailability.

Technologies: [Amazon AWS](https://junglewise.ai/threats/technologies/aws), [s2n-quic (crates.io)](https://junglewise.ai/threats/technologies/crates-io-s2n-quic). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon), [AWS](https://junglewise.ai/threats/vendors/aws), [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-10740 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10740 being exploited in the wild.

**How severe is CVE-2026-10740?** High severity, with a CVSS score of 5.3, published 10 June 2026.

**Which products and versions are affected?** AWS S2n-Quic < 1.82.0, <= 1.81.0; s2n-quic (crates.io) SEMVER:introduced=0,fixed=1.82.0.

**Is there a fix for CVE-2026-10740?** Yes. s2n-quic (crates.io): upgrade to 1.82.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10740 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-10740?** Check whether you run Amazon AWS, AWS S2n-Quic or s2n-quic (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- s2n-quic (crates.io): upgrade to 1.82.0 or later

  ```sh
  cargo update -p s2n-quic
  ```


## Technical details

This vulnerability involves excessive memory allocation in s2n-quic, the AWS QUIC protocol implementation. An attacker can exploit the memory allocation flaw through network-based attacks to cause denial of service by exhausting memory resources. The vulnerability is reachable over the network to any system running the affected s2n-quic library. No evidence of active exploitation in the wild has been reported. Patches or mitigations are available from AWS.

## Affected products

- AWS s2n-quic

## Identifiers

- CVE-2026-10740
- GHSA-9q54-f358-3fqf

## Timeline

- 2026-09-22: disclosed

## References

- [https://aws.amazon.com/security/security-bulletins/rss/2026-042-aws/](https://aws.amazon.com/security/security-bulletins/rss/2026-042-aws/)

## Related threats

- [An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0)](https://junglewise.ai/threats/cve-2026-126793-privilege-escalation-in-aurora-postgresql-dialect-detection-in)
- [AWS SDK for pandas EMR unverified bucket ownership](https://junglewise.ai/threats/cve-2026-127119-unverified-ownership-of-the-default-emr-cluster-log-location-in)
- [Amazon mcp-gateway-registry server-side request forgery in registration API](https://junglewise.ai/threats/cve-2026-125926-server-side-request-forgery-in-the-server-registration-and)
- [Amazon mcp-gateway-registry authorization bypass in management API](https://junglewise.ai/threats/cve-2026-100307-missing-authorization-on-the-external-management-api-in-mcp)
- [AWS Kiro CLI incorrect default permissions on session files](https://junglewise.ai/threats/cve-2026-124848-incorrect-default-permissions-on-session-transcripts-and-prompt)