# CVE-2026-44435: H2O Quicly assertion failure in CRYPTO stream handling

Source: https://junglewise.ai/threats/cve-2026-44435-h2o-quicly-assertion-failure-in-crypto-stream-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-44435 · Severity: high · CVSS 7.5 · Published 2026-07-16

Quicly is a software library used by the H2O web server to handle modern internet traffic. A flaw in how it processes encrypted handshake messages allows a remote attacker to crash the server by sending a specific sequence of data. This results in a denial-of-service, making the website or service unavailable to legitimate users.

Technologies: [H2o Quicly](https://junglewise.ai/threats/technologies/quicly). Vendors: [H2o](https://junglewise.ai/threats/vendors/h2o).

## Quick answers

**Is CVE-2026-44435 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44435 being exploited in the wild.

**How severe is CVE-2026-44435?** High severity, with a CVSS score of 7.5, published 16 July 2026.

**Which products and versions are affected?** H2o Quicly Prior to commit 937d0e9.

**Is there a fix for CVE-2026-44435?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44435 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44435?** Check whether you run H2o Quicly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reachable assertion vulnerability exists in Quicly's handling of CRYPTO streams. The software triggers an assertion failure (CWE-617) when it receives more than 32KB of valid handshake messages within a single packet number space. This occurs due to uncontrolled resource consumption (CWE-400) during the QUIC handshake process. An unauthenticated remote attacker can exploit this by sending a large volume of handshake data, leading to an immediate process crash and denial of service. The issue is resolved in commit 937d0e9.

## Affected products

- h2o quicly Prior to commit 937d0e9

## Timeline

- 2026-05-29: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD

## References

- [https://github.com/h2o/quicly/commit/937d0e9e7c669fc2bee4920632ab6aaac60e4d81](https://github.com/h2o/quicly/commit/937d0e9e7c669fc2bee4920632ab6aaac60e4d81)
- [https://github.com/h2o/quicly/security/advisories/GHSA-2cw9-5673-73gv](https://github.com/h2o/quicly/security/advisories/GHSA-2cw9-5673-73gv)

## Related threats

- [h2o Quicly denial of service via Connection ID buffer overflow](https://junglewise.ai/threats/cve-2026-44436-h2o-quicly-denial-of-service-via-connection-id-buffer-overflow)
- [h2o Quicly stateless reset injection in lib/quicly.c](https://junglewise.ai/threats/cve-2026-44434-h2o-quicly-stateless-reset-injection-in-lib-quicly-c)
- [h2o quicly resource exhaustion in flow control credit management](https://junglewise.ai/threats/cve-2026-44433-h2o-quicly-resource-exhaustion-in-flow-control-credit-management)