How do I check whether I am affected by GHSA-5rw2-6x5m-v22x?

- Check the s2n-quic version in Cargo.lock: `grep -A1 'name = "s2n-quic"' Cargo.lock` - Check whether the server sets a Retry token or address validation option in its s2n-quic endpoint configuration (unknown which option name the sources use)

What is the fix for GHSA-5rw2-6x5m-v22x?

- Upgrade s2n-quic to `1.89.0` or later - Patch any forked or derivative copies of s2n-quic with the upstream fix - No workaround exists; upgrading is the remediation

Who is not affected by GHSA-5rw2-6x5m-v22x?

Not affected if: aws-managed-services, client-only, default-config.

Live › vulnerability › GHSA-5rw2-6x5m-v22x

Go to dashboard

highPackage

CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic

s2n-quic, AWS's Rust QUIC library, fails to validate Destination Connection ID length when a server is configured to send Retry packets. An unauthenticated attacker can shut down a server endpoint with a single crafted UDP datagram.

Summary written from the sources below. Check the originals before acting.

Known so far

4/6

high

no CVSS yet; severity from the sources

known so far4 of 6

missing: versions, exploitation

First public: Sep 22, 2026 UTC
Last modified: Oct 25, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-24 19:28 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Yes.
Reachable from: internet.
Worst case: Unauthenticated attacker shuts down a QUIC server endpoint.
CVSS said: No score. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Only server endpoints that are specifically configured to issue QUIC Retry packets are affected, and only when running s2n-quic or earlier. AWS services are not affected and AWS customers do not need to act. Client-only uses and servers that do not send Retry packets are not affected according to the sources.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › GHSA-5rw2-6x5m-v22x

Go to dashboard

highPackage

CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic

Summary written from the sources below. Check the originals before acting.

Known so far

4/6

high

no CVSS yet; severity from the sources

known so far4 of 6

missing: versions, exploitation

First public: Sep 22, 2026 UTC
Last modified: Oct 25, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-24 19:28 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Yes.
Reachable from: internet.
Worst case: Unauthenticated attacker shuts down a QUIC server endpoint.
CVSS said: No score. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic

Sources