Live › vulnerability › CVE-2026-94450
Go to dashboards2n-quic, AWS's Rust implementation of QUIC, does not properly validate the Destination Connection ID length when a server is set to send Retry packets. A single crafted UDP datagram from an unauthenticated sender shuts down that server endpoint.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:28 UTC, 1h before NVD. All times on this page are UTC.
Only servers that use s2n-quic and are specifically configured to issue Retry packets are exposed, and the attacker needs only to send one UDP datagram. AWS services are not affected and AWS customers do not need to act. Teams running their own QUIC servers on s2n-quic 1.88.0 or earlier, including forks, should check.
No product ranges from the sources yet.
Cargo.lock with grep -A1 'name = "s2n-quic"' Cargo.lock; affected is <= 1.88.0grep -rn 'retry' src/ for a Retry token provider or Retry configuration in the QUIC endpoint setup1.89.0 or later with cargo update -p s2n-quicEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic
Bulletin ID: 2026-116-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/22/2026 13:00 PM PDT
Description:
s2n-quic is a Rust implementation of the QUIC protocol. We identified CVE-2026-94450, an issue with improper validation of the Destination Connection ID length when a server is configured to send Retry packets. s2n-quic 1.88.0 and earlier allow an unauthenticated user to shut down a server endpoint via a single crafted UDP datagram. No AWS services are affected by this issue, and customers of AWS services do not need to take action. Only server endpoints specifically configured to issue Retry packets are affected.
Impacted versions: <= v1.88.0
Resolution:
This issue has been addressed in s2n-quic version 1.89.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
There is no workaround that mitigates this issue. Upgrading to the patched version is the recommended remediation.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-94450")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.