Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit dccf5d4, Quicly was vulnerable to stateless reset injection through lack of packet entry validation. The QUIC protocol is designed to withstand packet injection attacks, once the handshake is complete. Only packets that carry some secret patterns are considered as stateless resets. Quicly allows the peer to share up to 4 such patterns per connection. However, until now, it failed to determine which of the 4 slots that it uses to retain the secret patterns contains a valid entry. As the slots are zero-initialized, the failure meant that, unless the peer advertised 4 of such patterns, an all-zero pattern was treated as a stateless reset.In effect, this allowed an on-path attacker to reset QUIC connections governed by Quicly. This issue has been fixed by commit dccf5d4.
CVE-2026-44434
This medium-severity CVE scores 5.3 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.1%, top 96% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
- Lower severity and no public exploit yet
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 5.3
- EG Score
- 5.3(medium)
- EG Risk
- 39(Track)EG Risk 39/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity53% × 45%Exploitation0% × 40%Automatability100% × 15%Action: Routine — remediate on your standard cadence. - EPSS
- 4.4%
- KEV
- Not listed
Published
July 16, 2026
Last Modified
July 18, 2026
Advisory Details (2)
Auto-updated Jul 17, 2026stateless reset injection · Advisory · h2o/quicly · GitHub
https://github.com/h2o/quicly/security/advisories/GHSA-899f-49jq-pfh8commit dccf5d4579c7 (h2o/quicly)
Fix landed in h2o/quicly commit dccf5d4579c7 — awaiting tagged release
https://github.com/h2o/quicly/commit/dccf5d4579c7ae9dd6e8f90c36d52e311bb60710Weakness Classification(2)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 9× in last 7d / 9× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-07-23 03:15 UTCEG score recompute
- 2026-07-22 14:08 UTCEPSS rescore
- 2026-07-21 15:24 UTCEPSS rescore
- 2026-07-20 17:08 UTCEPSS rescore
- 2026-07-19 14:31 UTCEPSS rescore
- 2026-07-19 02:32 UTCEG score recompute
- 2026-07-18 10:04 UTCEPSS rescore
- 2026-07-16 23:43 UTCEG score recompute
- 2026-07-16 23:43 UTCNVD updatefirst tracked
Frequently asked(5)
What is CVE-2026-44434?
When was CVE-2026-44434 disclosed?
Is CVE-2026-44434 actively exploited?
What is the CVSS score of CVE-2026-44434?
How do I remediate CVE-2026-44434?
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2026-44434
Is Your Infrastructure Affected by CVE-2026-44434?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.