---
id: "CVE-2026-94450"
kind: "vulnerability"
aliases: ["CVE-2026-94450"]
title: "s2n-quic: crafted UDP packet shuts down Retry-configured QUIC servers"
severity: "high"
cvss: 8.7
epss: 0.01944
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aws", "lab-disclosure", "package", "quic", "rust", "s2n-quic", "self-hosted"]
not_affected_if: ["aws-managed-services", "client-only", "default-config"]
published_at: "2026-09-22T00:00:00+00:00"
first_seen_at: "2026-10-24T19:28:16+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-116-aws/", "first_seen_at": "2026-10-24T19:28:16+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94450", "first_seen_at": "2026-10-24T20:15:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-94450", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# s2n-quic: crafted UDP packet shuts down Retry-configured QUIC servers

s2n-quic, AWS's Rust implementation of QUIC, does not properly validate the Destination Connection ID length when a server is set to send Retry packets. A single crafted UDP datagram from an unauthenticated sender shuts down that server endpoint.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the s2n-quic version in `Cargo.lock` with `grep -A1 'name = "s2n-quic"' Cargo.lock`; affected is `<= 1.88.0`
- Check whether the server sets Retry packets, e.g. `grep -rn 'retry' src/` for a Retry token provider or Retry configuration in the QUIC endpoint setup

## Fix

- Upgrade s2n-quic to `1.89.0` or later with `cargo update -p s2n-quic`
- Patch any forked or vendored copy of s2n-quic to include the fix
- No workaround exists; upgrading is the only remediation

## Timeline

- 2026-10-24T19:28:16+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-116-aws/ — AWS: CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic
- 2026-10-24T20:15:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94450
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-94450

## Documents

- [advisory] AWS: CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic https://aws.amazon.com/security/security-bulletins/rss/2026-116-aws/

## From the sources

CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic

### CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic

Bulletin ID: 2026-116-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/22/2026 13:00 PM PDT

Description:

s2n-quic is a Rust implementation of the QUIC protocol. We identified CVE-2026-94450, an issue with improper validation of the Destination Connection ID length when a server is configured to send Retry packets. s2n-quic 1.88.0 and earlier allow an unauthenticated user to shut down a server endpoint via a single crafted UDP datagram. No AWS services are affected by this issue, and customers of AWS services do not need to take action. Only server endpoints specifically configured to issue Retry packets are affected.

Impacted versions: <= v1.88.0

Resolution:

This issue has been addressed in s2n-quic version 1.89.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There is no workaround that mitigates this issue. Upgrading to the patched version is the recommended remediation.

References:

- CVE-2026-94450
- GHSA-5rw2-6x5m-v22x

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_