Executive brief
Quicly is a software library that implements the QUIC network protocol, primarily used by the H2O web server to handle internet traffic. A flaw in how the library manages data flow allows a malicious user to force the server to allocate excessive amounts of memory using very little network traffic. This can lead to a denial-of-service condition where the server crashes or becomes unresponsive due to memory exhaustion, potentially disrupting website availability.
Technical details
A resource exhaustion vulnerability exists in Quicly due to improper handling of connection-level flow control credits. An adversarial peer can send a STREAM frame containing a single byte at the maximum permitted offset, which incorrectly triggers the allocation of additional flow control credit. If the host application (such as H2O) pre-allocates receive buffers for out-of-order data up to the largest received offset, an attacker can cause significant memory consumption with minimal packet overhead. In H2O's default configuration, this can increase memory allocation per connection by approximately four times. The issue is addressed in commit 8b178e6.
Affected products
- h2o quicly Prior to commit 8b178e6
Timeline
- 2026-05-29: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD
- 2026-07-16: patched: Fix identified in commit 8b178e6