Quicly, an IETF QUIC protocol implementation used primarily in the H2O HTTP server, suffers from a denial‑of‑service flaw due to connection state corruption. Older versions before commit 8b178e6 accept Connection IDs up to 255 bytes while internally allocating only 20‑byte buffers for QUIC version 1 packets. Applications that do not enforce the CID length restriction can cause the library to overwrite its buffer, though the overflow remains within the allocated chunk. The bug triggers assertion failures that crash the application, leading to a loss of service. This corresponds to a classic buffer overrun (CWE‑120) and an out‑of‑bounds write (CWE‑787); it does not expose data or allow privilege escalation.

The vulnerability exists in all releases of quicly prior to commit 8b178e6. It affects any deployment that incorporates the library without adding its own verification of Connection ID length. Typical users include the H2O HTTP server and any application that links against quicly for QUIC support.

The CVSS score of 7.5 indicates a high severity. The EPSS score is less than 1 %, suggesting that exploitation is unlikely but still possible, especially in environments that expose the QUIC interface to untrusted traffic. As the issue is not listed in CISA KEV, there is no known widespread exploitation yet. The likely attack vector is network‑level, where an attacker sends a QUIC packet with an oversized Connection ID to a vulnerable server, causing the library to assert and crash. The absence of a builtin enforcement means the flaw can be triggered remotely by anyone able to send QUIC traffic to the target.