Executive brief
Quicly is a software library used to implement the QUIC network protocol, primarily used by the H2O web server to handle internet traffic. A flaw in how the library processes connection identifiers allows a remote attacker to send specially crafted data that crashes the service. This results in a denial-of-service, making the web server or application unavailable to legitimate users.
Technical details
A buffer overflow vulnerability exists in the Quicly library due to inconsistent enforcement of Connection ID (CID) lengths. While QUIC version 1 restricts CIDs to 20 bytes, Quicly's packet decoder accepted CIDs up to 255 bytes to maintain compatibility with unknown versions. The library failed to reject QUIC v1 packets exceeding the 20-byte limit, leading to a buffer overrun and connection state corruption. Although the overflow is contained within allocated memory chunks, it triggers assertion failures that crash the application. This is exploitable by a remote, unauthenticated attacker via the network. The issue is resolved in commit 8b178e6.
Affected products
- h2o Quicly Prior to commit 8b178e6
Timeline
- 2026-05-29: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD
- 2026-07-16: patched: Fix identified in commit 8b178e6