h2o quicly Stateless Reset Validator injection

Summaryinfo

A vulnerability, which was classified as problematic, was found in h2o quicly. The affected element is an unknown function of the component Stateless Reset Validator. Such manipulation leads to injection. This vulnerability is uniquely identified as CVE-2026-44434. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in h2o quicly (affected version not known). It has been rated as problematic. Affected by this issue is some unknown functionality of the component Stateless Reset Validator. The manipulation with an unknown input leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is availability. CVE summarizes:

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit dccf5d4, Quicly was vulnerable to stateless reset injection through lack of packet entry validation. The QUIC protocol is designed to withstand packet injection attacks, once the handshake is complete. Only packets that carry some secret patterns are considered as stateless resets. Quicly allows the peer to share up to 4 such patterns per connection. However, until now, it failed to determine which of the 4 slots that it uses to retain the secret patterns contains a valid entry. As the slots are zero-initialized, the failure meant that, unless the peer advertised 4 of such patterns, an all-zero pattern was treated as a stateless reset.In effect, this allowed an on-path attacker to reset QUIC connections governed by Quicly. This issue has been fixed by commit dccf5d4.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-44434 since 05/06/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1055 by the MITRE ATT&CK project.

Applying the patch dccf5d4 is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• h2o

Name

• quicly

Website

• Product: https://github.com/h2o/quicly/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion