CVE-2026-94450highCWE-1284CWE-617

CVE-2026-94450: high-severity vulnerability in AWS s2n-quic

Potential denial of service when configured to send Retry packets in s2n-quic

Published · Updated

Follow this CVE+ Monitor s2n-quic

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 1.9%
Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected. To remediate this issue, users should upgrade to version v1.89.0 or later.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
AWS · s2n-quic
Related CVEs — AWS s2n-quic

In the same product, most dangerous first.

CVE-2026-10740MEDIUMExcessive memory allocation in s2n-quicEPSS 0.3%