AWS S2n-quic vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting AWS S2n-quic: 2 record(s), with affected versions and fixes.
CVE-2026-94450
High · 7.5
CWE-1284 Sep 22, 2026
Potential denial of service when configured to send Retry packets in s2n-quic
Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected.
To remediate this issue, users should upgrade to version v1.89.0 or later.
CVE-2026-10740
Medium · 5.3
CWE-770 Jun 10, 2026
Excessive memory allocation in s2n-quic
Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a denial of service (degraded availability) by sending crafted QUIC Initial packets.
To remediate this issue, users should upgrade to v1.8.2.