The vulnerability exists in Quicly, an IETF QUIC protocol implementation that an attacker can send a single‑byte STREAM frame positioned at the largest offset allowed by the server to acquire additional flow control credit. Because Quicly prepares a receive buffer that can span up to the highest offset received, this crafted frame forces the application to allocate a large block of memory, even though only a handful of packets are sent. The resulting uncontrolled memory consumption can exhaust system RAM and lead to a denial‑of‑service. Additionally, the impact is amplified by the server’s stream concurrency configuration, which can increase per‑connection memory usage by roughly four times under default settings. This flaw is a classic uncontrolled resource consumption allocation limit problem (CWE‑770) and arises from untrusted input leading to resource exhaustion (CWE‑400).

Affected vendors are the h2o:quicly project and any deployments that incorporate that library, notably the H2O HTTP server. All versions of Quicly managed before the commit 8b178e692c51a3b1031612ef89f03a53aac63c15 contain the bug. The fixer commit introduces corrected buffer sizing logic that prevents the excessive allocation triggered by large offset frames.

The CVSS score is 5.3, indicating a medium overall severity, while the EPSS score of less than 1 % suggests that the vulnerability is not widely exploited at present. The flaw does not appear in CISA’s KEV catalog. An attacker must be able to initiate a QUIC connection to the vulnerable service and craft a particular can serve as the adversary, so exposure to the internet indirectly raises the risk. If triggered, the server may consume large amounts of RAM, potentially leading to service disruption. Given the low EPSS, regular monitoring and patching remain the most effective mitigation.