Is CVE-2026-44434 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44434 being exploited in the wild.

How severe is CVE-2026-44434?

Medium severity, with a CVSS score of 5.3, published 16 July 2026.

Which products and versions are affected?

H2o Quicly Prior to commit dccf5d4.

Is there a fix for CVE-2026-44434?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44434 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44434?

Check whether you run H2o Quicly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44434: h2o Quicly stateless reset injection in lib/quicly.c

CVE-2026-44434 · Severity: medium · CVSS 5.3 · Published 2026-07-16

Quicly, a networking library used by the H2O HTTP server to handle web traffic, contains a flaw in how it validates connection reset requests. An attacker positioned on the network path can send a specially crafted empty data pattern to prematurely terminate active web connections. This can lead to service disruptions and dropped connections for users accessing servers that rely on this library.

Technologies: H2o Quicly. Vendors: H2o.

Quick answers

Is CVE-2026-44434 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44434 being exploited in the wild.
How severe is CVE-2026-44434?: Medium severity, with a CVSS score of 5.3, published 16 July 2026.
Which products and versions are affected?: H2o Quicly Prior to commit dccf5d4.
Is there a fix for CVE-2026-44434?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44434 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44434?: Check whether you run H2o Quicly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Quicly, an IETF QUIC protocol implementation, fails to properly validate which of its four internal slots contain valid secret patterns for stateless resets. Because these slots are zero-initialized, the library incorrectly treats an all-zero pattern as a valid stateless reset token if the peer has not filled all four slots with legitimate patterns. An on-path attacker can exploit this by injecting a packet with an all-zero reset token, causing the library to terminate the connection. The root cause is a logic error in `is_stateless_reset` within `lib/quicly.c` where it failed to correctly iterate through and verify the state of remote Connection IDs (CIDs). This issue is addressed in commit dccf5d4.

Affected products

h2o Quicly Prior to commit dccf5d4

Timeline

2026-05-29: advisory: GitHub Security Advisory published
2026-07-16: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.