Quicly is an IETF QUIC protocol implementation used within the H2O HTTP server. Prior to commit dccf5d4, Quicly could accept stateless reset packets sent by an on‑path attacker because it did not validate which of the four shared secret patterns is active. QUIC expects reset packets to contain a secret pattern that only the communicating peers know; Quicly stores up to four such patterns, but failed to track which slot held a legitimate entry. As the unused slots are zero‑initialized, an all‑zero pattern was incorrectly treated as a valid stateless reset unless the peer advertised four patterns. This flaw allowed an attacker able to inject packets into an established QUIC session to reset the connection, effectively causing a denial‑of‑service.

The vulnerability resides in the h2o:quicly implementation of the QUIC protocol. Versions of Quicly before the commit with SHA dccf5d4579c7ae9dd6e8f90c36d52e311bb60710 contain the flaw. Quicly allows a peer to share up to four stateless reset patterns per connection, but it fails to validate which slot contains a legitimate entry, leading to zero‑initialized slots being treated as stateless resets. The patch introduces proper slot validation to prevent the misuse of zero‑initialized entries.

The CVSS score of 5.3 places the issue in the moderate range, while the EPSS score of less than 1% indicates a very low exploitation probability under current conditions. It is not listed in the CISA KEV catalog. An attacker who can intercept or inject traffic on a QUIC connection can exploit this flaw by sending an all‑zero stateless reset, causing the server to close the session prematurely. The weakness does not require prior authentication or privileged access, but does rely on the ability to send packets to the target connection.