Description
Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected.



To remediate this issue, users should upgrade to version v1.89.0 or later.
Published: 2026-09-22
Score: 8.7 High
EPSS: 1.9% Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

The vulnerability stems from improper validation of the Destination Connection ID length in s2n-quic versions 1.88.0 and earlier. When a server endpoint is configured to send Retry packets, a crafted UDP datagram can cause the endpoint to shut down, effectively denying service to legitimate traffic. This flaw is identified as CWE‑1284 and can be triggered by an unauthenticated remote user with a single malicious packet.

Affected Systems

Affected systems include AWS s2n-quic software, specifically version 1.88.0 and earlier. Only server endpoints configured to send Retry packets are impacted.

Risk and Exploitability

The CVSS score of 8.7 reflects a high severity risk, though the EPSS score of 2% indicates a low probability of exploitation yet. Because the flaw is limited to servers that send Retry packets, an attacker would need to discover an affected endpoint and send a single malicious UDP packet; successful exploitation results in the targeted endpoint shutting down. The vulnerability is not listed in KEV, so immediate precautionary measures should focus on updating to the patched version.

Generated by OpenCVE AI on September 23, 2026 at 15:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade s2n-quic to version 1.89.0 or later to fix the improper validation of Destination Connection ID length flaw (CWE‑1284).
  • Restart all s2n-quic server instances after the upgrade to activate the updated binary and ensure the CWE‑1284 fix is in effect.
  • Monitor s2n-quic logs for unexpected shutdowns or abnormal traffic patterns, and investigate promptly to detect any attempted denial‑of‑service activity.

Generated by OpenCVE AI on September 23, 2026 at 15:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected. To remediate this issue, users should upgrade to version v1.89.0 or later.
Title Potential denial of service when configured to send Retry packets in s2n-quic
First Time appeared Aws
Aws s2n-quic
Weaknesses CWE-1284
CPEs cpe:2.3:a:aws:s2n-quic:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws s2n-quic
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Aws S2n-quic
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-09-23T12:43:24.004Z

Reserved: 2026-09-21T16:50:04.257Z

Link: CVE-2026-94450

cve-icon Vulnrichment

Updated: 2026-09-23T12:43:18.568Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-22T21:17:33.867

Modified: 2026-09-23T17:58:37.490

Link: CVE-2026-94450

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T15:30:07Z

Weaknesses
  • CWE-1284

    Improper Validation of Specified Quantity in Input