CVE-2026-10740 - Excessive memory allocation in s2n-quic

highCVE-2026-10740

Bulletin ID: 2026-042-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/10/2026 11:15 AM PDT Description: s2n-quic is a Rust implementation of the QUIC protocol. We identified CVE-2026-10740, an issue of unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.82.0. An unauthenticated user can attempt to exhaust server memory on an s2n-quic endpoint by sending crafted CRYPTO frames with high offsets. The buffer used for processing CRYPTO frames does not enforce a maximum size. In the worst case, a single 1200-byte packet can cause approximately 9.4 MB of allocation. By repeatedly sending such packets, the resulting memory pressure could cause denial of service. No valid handshake is required. Impacted versions: < v1.82.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

vendor: AWS product: s2n-quic Denial of serviceaffected: < 1.82.0

What: Unbounded memory allocation can lead to denial of service by exhausting server memory.
Who is affected: Users of s2n-quic versions before 1.82.0.
Urgency: Remediation is important to prevent denial of service attacks.
Action: Update s2n-quic to version 1.82.0 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch s2n-quic

Get an email when a new s2n-quic advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: high
Published: 2026-06-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-042-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-107400.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-10740	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownCVE-2026-10740 - Excessive memory allocation in s2n-quicaws

Recent advisories for - Excessive memory

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-7639: Software installed and run as a non-privileged user may conduct a sequence of improper GPU syst…nvd · 2026-07-10
highCVE-2026-58499: EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal …nvd · 2026-07-10
unknownCVE-2026-45203: Kernel software installed and running inside a Host VM may post improper commands to the GPU F…nvd · 2026-07-10
unknownCVE-2026-41154: Software installed and run as a non-privileged user may cause OOB kernel memory reads or write…nvd · 2026-07-10
unknownCVE-2026-53653: Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthentica…nvd · 2026-07-10
mediumCVE-2026-8609: An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values,…nvd · 2026-07-10