Vulnerability Description
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, an adversarial peer could send a STREAM frame carrying just one byte at the largest offset being permitted to obtain additional flow control credit, which under certain circumstances could lead to a Denial of Service. Assuming the application prepares a receive buffer for storing all data that arrive out-of-order, up to the largest offset being received, this behavior could lead to the application allocating large amount of memory with the peer sending only a handful of packets, resulting in memory exhaustion. In addition to the receive buffer allocation strategy, the severity of this vulnerability depends on how the application controls the stream concurrency. In case of the H2O HTTP server, under its default setting, this bug increases the maximum amount of memory allocated per connection by about 4 times. This issue has been fixed by commit 8b178e6.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| H2O | Quicly | < 2026-05-29 |
Related Weaknesses (CWE)
References
- https://github.com/h2o/quicly/commit/8b178e692c51a3b1031612ef89f03a53aac63c15Patch
- https://github.com/h2o/quicly/security/advisories/GHSA-f7qr-4p37-9gx9Vendor Advisory
FAQ
What is CVE-2026-44433?
CVE-2026-44433 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, an adversarial peer could send a STREAM frame carrying just one byte at t...
How severe is CVE-2026-44433?
CVE-2026-44433 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-44433?
Check the references section above for vendor advisories and patch information. Affected products include: H2O Quicly.