CVE-2026-10740

highCVSS 5.3covered by 3 sourcesfirst seen 2026-08-14

s2n-quic is a Rust implementation of the QUIC protocol. An unauthenticated user can attempt to exhaust server memory on an s2n-quic endpoint by sending crafted CRYPTO frames with high offsets. The buffer used for processing CRYPTO frames does not enforce a maximum size. In the worst case, a single 1200-byte packet can cause approximately 9.4 MB of allocation. By repeatedly sending such packets, the resulting memory pressure could cause denial of service. No valid handshake is required. Impacted versions: <= v1.81.0 Patches This issue has been addressed in s2n-quic version v1.82.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Workarounds There is no workaround that fully mitigates this issue. Upgrading to the patched version is the recommended remediation. References If there are any questions or comments about this advisory, contact AWS Security via the vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

CSIRTS triage

What: Unbounded memory allocation can lead to denial of service by exhausting server memory.
Who is affected: Users of s2n-quic versions before 1.82.0.
Urgency: Remediation is important to prevent denial of service attacks.
Action: Update s2n-quic to version 1.82.0 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-10740

Get an email if CVE-2026-10740 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.

Advisory coverage (3)

highCVE-2026-10740 - Excessive memory allocation in s2n-quicaws · 2026-08-20
unknownCVE-2026-10740 - Excessive memory allocation in s2n-quicaws · 2026-08-20
mediumGHSA-9q54-f358-3fqf: s2n-quic has excessive memory allocationghsa · 2026-08-14

External references

NVD record for CVE-2026-10740

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-10740 status](https://www.csirts.com/badge/CVE-2026-10740)](https://www.csirts.com/cve/CVE-2026-10740)