Skip to content
OpenAdvisories

Product · h2o

quicly

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-44434

    Quicly is vulnerable to stateless reset injection

    Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit dccf5d4, Quicly was vulnerable to stateless reset injection through lack of packet entry validation. The QUIC protocol is designed to withsta…

    h2o quicly
  • Medium 5.3
    CVE-2026-44433

    Quicly is vulnerable to memory exhaustion

    Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, an adversarial peer could send a STREAM frame carrying just one byte at the largest offset being permitted to obtain additional flow…

    h2o quicly