The vulnerability in Quicly is an assertion failure triggered when the total number of valid handshake messages received over a CRYPTO stream in a single packet number space exceeds 32 KB. This causes the QUIC implementation to crash and results in a denial of service. The flaw corresponds to uncontrolled resource consumption (CWE‑400) and unchecked return value issues (CWE‑617). Attackers could trigger it by sending crafted QUIC handshake data that forces the server into a crash, disrupting availability for all users connected to the affected QUIC service. The issue has been addressed in commit 937d0e9.

The affected product is h2o's Quicly QUIC protocol implementation. No specific version numbers are listed, so any deployment of Quicly before commit 937d0e9 is considered vulnerable. This primarily impacts deployments of the H2O HTTP server that use Quicly for QUIC support.

The CVSS score of 7.5 indicates high severity. The EPSS score of less than 1 % suggests that exploitation is presently unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, as the flaw is triggered by network traffic over QUIC. No mitigations are listed other than the official fix, so the risk remains until the library is updated.