CVE-2026-94450

Received Received - Intake

Denial of Service in s2n-quic

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: AMZN

Description

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected. To remediate this issue, users should upgrade to version v1.89.0 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-94450

EUVD

EUVD-2026-84822

Affected Vendors & Products

Vendor	Product	Version / Range
aws	s2n-quic	to 1.89.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper validation of the Destination Connection ID length in s2n-quic versions 1.88.0 and earlier. An unauthenticated remote attacker can exploit this by sending a single crafted UDP datagram to shut down a server endpoint. Only servers configured to send Retry packets are vulnerable.

Detection Guidance

This vulnerability can be detected by checking the version of s2n-quic running on your system. If you are using version 1.88.0 or earlier, your system is vulnerable. Use the command 's2n-quic --version' to check the installed version.

Impact Analysis

This vulnerability can cause a denial of service by shutting down your server endpoint. This means your service may become unavailable to legitimate users, leading to downtime and potential loss of access for users relying on the service.

Compliance Impact

This vulnerability causes a denial of service by shutting down a server endpoint via a crafted UDP datagram. While it does not directly impact data confidentiality or integrity, it could lead to service unavailability, which may affect compliance with standards requiring high availability such as GDPR (data processing continuity) or HIPAA (system availability for protected health information).

Mitigation Strategies

Immediately upgrade s2n-quic to version 1.89.0 or later to remediate the issue. This can typically be done using your package manager, such as 'apt upgrade s2n-quic' or 'yum update s2n-quic'.

Hi! I’m here to help you understand CVE-2026-94450. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70