# CVE-2026-44434: h2o Quicly stateless reset injection in lib/quicly.c

Source: https://junglewise.ai/threats/cve-2026-44434-h2o-quicly-stateless-reset-injection-in-lib-quicly-c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-44434 · Severity: medium · CVSS 5.3 · Published 2026-07-16

Quicly, a networking library used by the H2O HTTP server to handle web traffic, contains a flaw in how it validates connection reset requests. An attacker positioned on the network path can send a specially crafted empty data pattern to prematurely terminate active web connections. This can lead to service disruptions and dropped connections for users accessing servers that rely on this library.

Technologies: [H2o Quicly](https://junglewise.ai/threats/technologies/quicly). Vendors: [H2o](https://junglewise.ai/threats/vendors/h2o).

## Quick answers

**Is CVE-2026-44434 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44434 being exploited in the wild.

**How severe is CVE-2026-44434?** Medium severity, with a CVSS score of 5.3, published 16 July 2026.

**Which products and versions are affected?** H2o Quicly Prior to commit dccf5d4.

**Is there a fix for CVE-2026-44434?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44434 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44434?** Check whether you run H2o Quicly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Quicly, an IETF QUIC protocol implementation, fails to properly validate which of its four internal slots contain valid secret patterns for stateless resets. Because these slots are zero-initialized, the library incorrectly treats an all-zero pattern as a valid stateless reset token if the peer has not filled all four slots with legitimate patterns. An on-path attacker can exploit this by injecting a packet with an all-zero reset token, causing the library to terminate the connection. The root cause is a logic error in `is_stateless_reset` within `lib/quicly.c` where it failed to correctly iterate through and verify the state of remote Connection IDs (CIDs). This issue is addressed in commit dccf5d4.

## Affected products

- h2o Quicly Prior to commit dccf5d4

## Timeline

- 2026-05-29: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD

## References

- [https://github.com/h2o/quicly/commit/dccf5d4579c7ae9dd6e8f90c36d52e311bb60710](https://github.com/h2o/quicly/commit/dccf5d4579c7ae9dd6e8f90c36d52e311bb60710)
- [https://github.com/h2o/quicly/security/advisories/GHSA-899f-49jq-pfh8](https://github.com/h2o/quicly/security/advisories/GHSA-899f-49jq-pfh8)

## Related threats

- [h2o Quicly denial of service via Connection ID buffer overflow](https://junglewise.ai/threats/cve-2026-44436-h2o-quicly-denial-of-service-via-connection-id-buffer-overflow)
- [H2O Quicly assertion failure in CRYPTO stream handling](https://junglewise.ai/threats/cve-2026-44435-h2o-quicly-assertion-failure-in-crypto-stream-handling)
- [h2o quicly resource exhaustion in flow control credit management](https://junglewise.ai/threats/cve-2026-44433-h2o-quicly-resource-exhaustion-in-flow-control-credit-management)