{"id":"GHSA-5rw2-6x5m-v22x","kind":"vulnerability","aliases":["GHSA-5rw2-6x5m-v22x"],"related":[],"title":"CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic","description":"CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic\n\n### CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic\n\nBulletin ID: 2026-116-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/22/2026 13:00 PM PDT\n\nDescription:\n\ns2n-quic is a Rust implementation of the QUIC protocol. We identified CVE-2026-94450, an issue with improper validation of the Destination Connection ID length when a server is configured to send Retry packets. s2n-quic 1.88.0 and earlier allow an unauthenticated user to shut down a server endpoint via a single crafted UDP datagram. No AWS services are affected by this issue, and customers of AWS services do not need to take action. Only server endpoints specifically configured to issue Retry packets are affected.\n\nImpacted versions: <= v1.88.0\n\nResolution:\n\nThis issue has been addressed in s2n-quic version 1.89.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround that mitigates this issue. Upgrading to the patched version is the recommended remediation.\n\nReferences:\n\n- CVE-2026-94450\n- GHSA-5rw2-6x5m-v22x\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"s2n-quic, AWS's Rust QUIC library, fails to validate Destination Connection ID length when a server is configured to send Retry packets. An unauthenticated attacker can shut down a server endpoint with a single crafted UDP datagram.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","lab-disclosure","package","quic","rust","s2n-quic","self-hosted"],"not_affected_if":["aws-managed-services","client-only","default-config"],"how_to_check":"- Check the s2n-quic version in Cargo.lock: `grep -A1 'name = \"s2n-quic\"' Cargo.lock`\n- Check whether the server sets a Retry token or address validation option in its s2n-quic endpoint configuration (unknown which option name the sources use)","fix":"- Upgrade s2n-quic to `1.89.0` or later\n- Patch any forked or derivative copies of s2n-quic with the upstream fix\n- No workaround exists; upgrading is the remediation","status":"open","published_at":"2026-09-22T00:00:00+00:00","first_seen_at":"2026-10-24T19:28:16+00:00","triaged_at":"2026-10-25T05:30:26+00:00","updated_at":"2026-10-25T05:30:26+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T05:30:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade s2n-quic to `1.89.0` or later\n- Patch any forked or derivative copies of s2n-quic with the upstream fix\n- No workaround exists; upgrading is the remediation","reach":"internet","title":"s2n-quic: crafted UDP datagram shuts down servers configured for Retry","impact":"medium","summary":"s2n-quic, AWS's Rust QUIC library, fails to validate Destination Connection ID length when a server is configured to send Retry packets. An unauthenticated attacker can shut down a server endpoint with a single crafted UDP datagram.","category":"package","nicknames":[],"who_cares":["rust","s2n-quic","quic","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"unauthenticated attacker shuts down a QUIC server endpoint","analyst_note":"","how_to_check":"- Check the s2n-quic version in Cargo.lock: `grep -A1 'name = \"s2n-quic\"' Cargo.lock`\n- Check whether the server sets a Retry token or address validation option in its s2n-quic endpoint configuration (unknown which option name the sources use)","needs_analyst":false,"not_affected_if":["aws-managed-services","client-only","default-config"],"who_is_affected":"Only server endpoints that are specifically configured to issue QUIC Retry packets are affected, and only when running s2n-quic `1.88.0` or earlier. AWS services are not affected and AWS customers do not need to act. Client-only uses and servers that do not send Retry packets are not affected according to the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":3776,"output_tokens":590,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116':117C '-2026':2A,81C,98C,148C,278C '-94450':3A,82C,99C,149C,279C '00':130C '09/22/2026':128C '1.88.0':173C '1.89.0':236C '13':129C '2026':116C '5rw2':20A,25A,282C '6x5m':21A,26A,283C 'action':210C 'address':230C 'affect':196C,221C 'allow':176C 'attack':67B 'attent':125C 'aw':28B,44B,118C,120C,193C,203C 'aws-security@amazon.com':287C 'bulletin':114C 'code':250C 'concern':293C 'configur':9A,60B,88C,105C,165C,215C 'connect':53B,158C 'content':121C 'craft':77B,189C 'custom':201C 'cve':1A,80C,97C,147C,277C 'datagram':79B,191C 'date':127C 'denial':5A,84C,101C 'deriv':249C 'descript':133C 'destin':52B,157C 'disclosur':31B 'earlier':175C 'email':286C 'endpoint':73B,185C,213C 'ensur':245C 'fail':49B 'fix':257C 'fork':247C 'ghsa':19A,24A,281C 'ghsa-5rw2-6x5m-v22x':18A,23A,280C 'host':40B 'id':54B,115C,159C 'identifi':146C 'impact':222C 'implement':140C 'import':123C 'improp':153C 'incorpor':254C 'issu':151C,199C,217C,227C,266C 'lab':30B 'lab-disclosur':29B 'latest':242C 'length':55B,160C 'librari':48B 'mitig':264C 'need':207C 'new':256C 'packag':32B 'packet':13A,64B,92C,109C,169C,219C 'patch':252C,270C 'pdt':132C 'pleas':285C 'pm':131C 'potenti':4A,83C,100C 'protocol':144C 'public':126C 'question':291C 'quic':17A,33B,37B,43B,47B,96C,113C,136C,143C,172C,234C 'recommend':238C,274C 'refer':276C 'remedi':275C 'requir':124C 'resolut':225C 'retri':12A,63B,91C,108C,168C,218C 'rust':34B,46B,139C 's2n':16A,36B,42B,95C,112C,135C,171C,233C 's2n-quic':15A,35B,41B,94C,111C,134C,170C,232C 'scope':119C 'secur':290C 'self':39B 'self-host':38B 'send':11A,62B,90C,107C,167C 'server':58B,72B,163C,184C,212C 'servic':7A,86C,103C,194C,204C 'shut':69B,181C 'singl':76B,188C 'specif':214C 'take':209C 'type':122C 'udp':78B,190C 'unauthent':66B,178C 'upgrad':239C,267C 'user':179C 'v1.88.0':224C 'v22x':22A,27A,284C 'valid':51B,154C 'version':223C,235C,243C,271C 'via':186C 'workaround':258C,262C","nicknames":[],"mitigations":[],"who_affected":"Only server endpoints that are specifically configured to issue QUIC Retry packets are affected, and only when running s2n-quic `1.88.0` or earlier. AWS services are not affected and AWS customers do not need to act. Client-only uses and servers that do not send Retry packets are not affected according to the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-22T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-116-aws/#GHSA-5rw2-6x5m-v22x","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-116-aws/","severity":null,"published_at":"2026-09-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:28:16+00:00","fetched_at":"2026-10-25T08:14:50+00:00","note":"AWS: CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic"}],"documents":[{"id":2948,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-116-aws/","title":"AWS: CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic","kind":"advisory","source":"lab","text":"CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic\n\n### CVE-2026-94450 - Potential denial of service when configured to send Retry packets in s2n-quic\n\nBulletin ID: 2026-116-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/22/2026 13:00 PM PDT\n\nDescription:\n\ns2n-quic is a Rust implementation of the QUIC protocol. We identified CVE-2026-94450, an issue with improper validation of the Destination Connection ID length when a server is configured to send Retry packets. s2n-quic 1.88.0 and earlier allow an unauthenticated user to shut down a server endpoint via a single crafted UDP datagram. No AWS services are affected by this issue, and customers of AWS services do not need to take action. Only server endpoints specifically configured to issue Retry packets are affected.\n\nImpacted versions: <= v1.88.0\n\nResolution:\n\nThis issue has been addressed in s2n-quic version 1.89.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround that mitigates this issue. Upgrading to the patched version is the recommended remediation.\n\nReferences:\n\n- CVE-2026-94450\n- GHSA-5rw2-6x5m-v22x\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-09-22T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}