CVE-2026-44434: on-path attacker can force QUIC

CISO Take

Quicly, the QUIC implementation embedded in the H2O HTTP server, failed to validate which of its 4 stateless-reset-token slots actually held a peer-supplied secret, so an all-zero (uninitialized) slot could be mistaken for a valid reset token. An on-path attacker — someone who can observe and inject packets into the network path, such as on a compromised Wi-Fi network or router — could exploit this to forcibly tear down QUIC connections without needing to break TLS or hold any credentials. The practical severity is low: CVSS 5.3, no confidentiality or integrity impact, only availability (single connections get reset, not a full outage), there is no public exploit, no Nuclei template, and it is not in CISA KEV; EPSS sits at 0.15%, meaning real-world exploitation is currently very unlikely. Action: upgrade Quicly to a version including commit dccf5d4 (fixed upstream) if you run or embed H2O's HTTP/3 stack, and monitor for unusual spikes in QUIC connection resets as a detection signal. Important caveat for this feed: this CVE affects the H2O HTTP server project, not the H2O.ai machine-learning package (`h2o` on PyPI) tracked in our AI/ML catalog — it appears here due to a name collision, not because it touches an AI/ML component.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

Low-to-moderate operational risk. The flaw only affects availability (forced connection resets), not data confidentiality or integrity — CVSS vector confirms C:N/I:N/A:L. Exploitation requires an on-path position (interception/injection capability on the network path), which raises the practical bar above a purely remote, unauthenticated attack despite AV:N/AC:L/PR:N/UI:N. No public exploit code, no scanner template, and no CISA KEV listing exist. EPSS of 0.15% places this well outside the population of CVEs likely to see active exploitation in the near term. Overall this is best treated as a routine patch-cycle item rather than an urgent fire drill.

How does the attack unfold?

On-path positioning

Attacker gains a position to observe and inject packets into the network path between client and H2O/Quicly server (e.g., rogue AP, compromised router).

Forge stateless reset

Attacker crafts a QUIC packet with an all-zero pattern matching an uninitialized, unvalidated reset-token slot.

Connection termination

Quicly incorrectly accepts the forged packet as a valid stateless reset and forcibly tears down the legitimate QUIC connection.

AML.T0029

On-path positioning

Attacker gains a position to observe and inject packets into the network path between client and H2O/Quicly server (e.g., rogue AP, compromised router).

Forge stateless reset

Attacker crafts a QUIC packet with an all-zero pattern matching an uninitialized, unvalidated reset-token slot.

Connection termination

Quicly incorrectly accepts the forged packet as a valid stateless reset and forcibly tears down the legitimate QUIC connection.

AML.T0029

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A Low

What should I do?

1 step

1) Identify whether any AI-facing infrastructure (API gateways, load balancers, inference endpoints) uses H2O HTTP server / Quicly for QUIC or HTTP3 termination. 2) Upgrade Quicly to a release that includes commit dccf5d4 (or later), which adds proper validation of which stateless-reset-token slots are populated. 3) If immediate patching isn't possible, consider disabling QUIC/HTTP3 support and falling back to TCP/TLS 1.3 as a temporary workaround, since the flaw is specific to the QUIC stateless-reset path. 4) Detection: monitor QUIC connection logs for abnormal or unexplained spikes in connection resets, particularly from a single upstream path, which could indicate stateless-reset injection attempts. 5) No credential rotation or data-integrity remediation is required — this is an availability-only issue.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Inference AML.T0029 - Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system operation and monitoring

Frequently Asked Questions

What is CVE-2026-44434?

Quicly, the QUIC implementation embedded in the H2O HTTP server, failed to validate which of its 4 stateless-reset-token slots actually held a peer-supplied secret, so an all-zero (uninitialized) slot could be mistaken for a valid reset token. An on-path attacker — someone who can observe and inject packets into the network path, such as on a compromised Wi-Fi network or router — could exploit this to forcibly tear down QUIC connections without needing to break TLS or hold any credentials. The practical severity is low: CVSS 5.3, no confidentiality or integrity impact, only availability (single connections get reset, not a full outage), there is no public exploit, no Nuclei template, and it is not in CISA KEV; EPSS sits at 0.15%, meaning real-world exploitation is currently very unlikely. Action: upgrade Quicly to a version including commit dccf5d4 (fixed upstream) if you run or embed H2O's HTTP/3 stack, and monitor for unusual spikes in QUIC connection resets as a detection signal. Important caveat for this feed: this CVE affects the H2O HTTP server project, not the H2O.ai machine-learning package (`h2o` on PyPI) tracked in our AI/ML catalog — it appears here due to a name collision, not because it touches an AI/ML component.

Is CVE-2026-44434 actively exploited?

No confirmed active exploitation of CVE-2026-44434 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-44434?

1) Identify whether any AI-facing infrastructure (API gateways, load balancers, inference endpoints) uses H2O HTTP server / Quicly for QUIC or HTTP3 termination. 2) Upgrade Quicly to a release that includes commit dccf5d4 (or later), which adds proper validation of which stateless-reset-token slots are populated. 3) If immediate patching isn't possible, consider disabling QUIC/HTTP3 support and falling back to TCP/TLS 1.3 as a temporary workaround, since the flaw is specific to the QUIC stateless-reset path. 4) Detection: monitor QUIC connection logs for abnormal or unexplained spikes in connection resets, particularly from a single upstream path, which could indicate stateless-reset injection attempts. 5) No credential rotation or data-integrity remediation is required — this is an availability-only issue.

What systems are affected by CVE-2026-44434?

This vulnerability affects the following AI/ML architecture patterns: API gateways / reverse proxies fronting model-serving or inference endpoints (only if built on H2O + Quicly for HTTP/3).

What is the CVSS score for CVE-2026-44434?

CVE-2026-44434 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

API gateways / reverse proxies fronting model-serving or inference endpoints (only if built on H2O + Quicly for HTTP/3)

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

Compliance Controls Affected

ISO 42001: A.6.2.6

What are the technical details?

Original Advisory

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit dccf5d4, Quicly was vulnerable to stateless reset injection through lack of packet entry validation. The QUIC protocol is designed to withstand packet injection attacks, once the handshake is complete. Only packets that carry some secret patterns are considered as stateless resets. Quicly allows the peer to share up to 4 such patterns per connection. However, until now, it failed to determine which of the 4 slots that it uses to retain the secret patterns contains a valid entry. As the slots are zero-initialized, the failure meant that, unless the peer advertised 4 of such patterns, an all-zero pattern was treated as a stateless reset.In effect, this allowed an on-path attacker to reset QUIC connections governed by Quicly. This issue has been fixed by commit dccf5d4.

Exploitation Scenario

An attacker who can observe and inject packets into the network path between a client and an H2O-fronted service (e.g., via a rogue Wi-Fi access point, a compromised router, or ARP/BGP-level interception) crafts a QUIC stateless-reset packet using an all-zero token. If the legitimate peer hasn't yet advertised all 4 of its stateless-reset patterns to Quicly, the zero-initialized (empty) slot is mistakenly treated as valid, and Quicly accepts the forged packet as a genuine stateless reset. This forces the targeted QUIC connection to terminate immediately — for example, disrupting a streaming inference response or an API session routed through an H2O/HTTP3 front end — without the attacker needing to break TLS, steal credentials, or interact with the application layer at all.

Weaknesses (CWE)

CWE-345 Insufficient Verification of Data Authenticity Primary CWE-665 Improper Initialization Primary CWE-345 Insufficient Verification of Data Authenticity CWE-665 Improper Initialization

CWE-345 — Insufficient Verification of Data Authenticity: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Source: MITRE CWE corpus.