Is CVE-2026-44433 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44433 being exploited in the wild.

How severe is CVE-2026-44433?

Medium severity, with a CVSS score of 5.3, published 16 July 2026.

Which products and versions are affected?

H2o Quicly Prior to commit 8b178e6.

Is there a fix for CVE-2026-44433?

A patch was published on 2026-07-16: Fix identified in commit 8b178e6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44433 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44433?

Check whether you run H2o Quicly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44433: h2o quicly resource exhaustion in flow control credit management

CVE-2026-44433 · Severity: medium · CVSS 5.3 · Published 2026-07-16

Quicly is a software library that implements the QUIC network protocol, primarily used by the H2O web server to handle internet traffic. A flaw in how the library manages data flow allows a malicious user to force the server to allocate excessive amounts of memory using very little network traffic. This can lead to a denial-of-service condition where the server crashes or becomes unresponsive due to memory exhaustion, potentially disrupting website availability.

Technologies: H2o Quicly. Vendors: H2o.

Quick answers

Is CVE-2026-44433 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44433 being exploited in the wild.
How severe is CVE-2026-44433?: Medium severity, with a CVSS score of 5.3, published 16 July 2026.
Which products and versions are affected?: H2o Quicly Prior to commit 8b178e6.
Is there a fix for CVE-2026-44433?: A patch was published on 2026-07-16: Fix identified in commit 8b178e6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44433 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44433?: Check whether you run H2o Quicly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability exists in Quicly due to improper handling of connection-level flow control credits. An adversarial peer can send a STREAM frame containing a single byte at the maximum permitted offset, which incorrectly triggers the allocation of additional flow control credit. If the host application (such as H2O) pre-allocates receive buffers for out-of-order data up to the largest received offset, an attacker can cause significant memory consumption with minimal packet overhead. In H2O's default configuration, this can increase memory allocation per connection by approximately four times. The issue is addressed in commit 8b178e6.

Affected products

h2o quicly Prior to commit 8b178e6

Timeline

2026-05-29: advisory: GitHub Security Advisory published
2026-07-16: disclosed: CVE published to NVD
2026-07-16: patched: Fix identified in commit 8b178e6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.