Vulnerability Description
Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected. To remediate this issue, users should upgrade to version v1.89.0 or later.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://aws.amazon.com/security/security-bulletins/2026-116-aws/
- https://github.com/aws/s2n-quic/releases/tag/v1.89.0
- https://github.com/aws/s2n-quic/security/advisories/GHSA-5rw2-6x5m-v22x
FAQ
What is CVE-2026-94450?
CVE-2026-94450 is a vulnerability with a CVSS score of 7.5 (HIGH). Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via ...
How severe is CVE-2026-94450?
CVE-2026-94450 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-94450?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.