CVE-2026-44435: Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number

highCVSS 7.5CVE-2026-44435

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a Denial of Service. This issue has been fixed by commit 937d0e9.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.5
Published: 2026-07-16
Last updated: 2026-07-17
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-44435

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-444350.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-44435	coverage & exploitation status	NVD · CVE.org

Recent advisories for Quicly is an

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-17733: Inappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowe…nvd · 2026-07-30
criticalCVE-2026-17673: Integer overflow in QUIC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who…nvd · 2026-07-30
highCVE-2026-66374: Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in th…nvd · 2026-07-25
highCVE-2026-25800: Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Sta…nvd · 2026-07-23
lowCVE-2026-41637: In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ)…nvd · 2026-07-22
highCVE-2026-32665: In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) i…nvd · 2026-07-22

CVE-2026-44435: Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number

Details

Exploitation outlook

Referenced CVEs

Recent advisories for Quicly is an

More from NVD Recent CVEs