CVE-2026-94450

Potential denial of service when configured to send Retry packets in s2n-quic

State: Published
Severity: 8.7 High
Published: Sep 22, 2026
Updated: Oct 20, 2026
Reserved: Sep 21, 2026

Description

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected.

To remediate this issue, users should upgrade to version v1.89.0 or later.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	AMZN
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	AMZN

Weaknesses

CWE-1284 Improper validation of specified quantity in input
CWE-617 Reachable assertion

Affected Products

Product	Versions
s2n-quicAWS	1.88.0 and earlierAffected

References

https://github.com/aws/s2n-quic/releases/tag/v1.89.0patchrelease-notes
https://aws.amazon.com/security/security-bulletins/2026-116-aws/vendor-advisory
https://github.com/aws/s2n-quic/security/advisories/GHSA-5rw2-6x5m-v22xrelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.