# CVE-2026-44436: h2o Quicly denial of service via Connection ID buffer overflow

Source: https://junglewise.ai/threats/cve-2026-44436-h2o-quicly-denial-of-service-via-connection-id-buffer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-44436 · Severity: high · CVSS 7.5 · Published 2026-07-16

Quicly is a software library used to implement the QUIC network protocol, primarily used by the H2O web server to handle internet traffic. A flaw in how the library processes connection identifiers allows a remote attacker to send specially crafted data that crashes the service. This results in a denial-of-service, making the web server or application unavailable to legitimate users.

Technologies: [H2o Quicly](https://junglewise.ai/threats/technologies/quicly). Vendors: [H2o](https://junglewise.ai/threats/vendors/h2o).

## Quick answers

**Is CVE-2026-44436 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44436 being exploited in the wild.

**How severe is CVE-2026-44436?** High severity, with a CVSS score of 7.5, published 16 July 2026.

**Which products and versions are affected?** H2o Quicly Prior to commit 8b178e6.

**Is there a fix for CVE-2026-44436?** A patch was published on 2026-07-16: Fix identified in commit 8b178e6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44436 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44436?** Check whether you run H2o Quicly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer overflow vulnerability exists in the Quicly library due to inconsistent enforcement of Connection ID (CID) lengths. While QUIC version 1 restricts CIDs to 20 bytes, Quicly's packet decoder accepted CIDs up to 255 bytes to maintain compatibility with unknown versions. The library failed to reject QUIC v1 packets exceeding the 20-byte limit, leading to a buffer overrun and connection state corruption. Although the overflow is contained within allocated memory chunks, it triggers assertion failures that crash the application. This is exploitable by a remote, unauthenticated attacker via the network. The issue is resolved in commit 8b178e6.

## Affected products

- h2o Quicly Prior to commit 8b178e6

## Timeline

- 2026-05-29: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD
- 2026-07-16: patched: Fix identified in commit 8b178e6

## References

- [https://github.com/h2o/quicly/commit/8b178e692c51a3b1031612ef89f03a53aac63c15](https://github.com/h2o/quicly/commit/8b178e692c51a3b1031612ef89f03a53aac63c15)
- [https://github.com/h2o/quicly/security/advisories/GHSA-v55w-59qx-2v78](https://github.com/h2o/quicly/security/advisories/GHSA-v55w-59qx-2v78)

## Related threats

- [H2O Quicly assertion failure in CRYPTO stream handling](https://junglewise.ai/threats/cve-2026-44435-h2o-quicly-assertion-failure-in-crypto-stream-handling)
- [h2o Quicly stateless reset injection in lib/quicly.c](https://junglewise.ai/threats/cve-2026-44434-h2o-quicly-stateless-reset-injection-in-lib-quicly-c)
- [h2o quicly resource exhaustion in flow control credit management](https://junglewise.ai/threats/cve-2026-44433-h2o-quicly-resource-exhaustion-in-flow-control-credit-management)