CVE-2024-45396

Published: Oct 11, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Quicly is an IETF QUIC protocol implementation. Quicly up to commtit d720707 is susceptible to a denial-of-service attack. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using quicly. The vulnerability is addressed with commit 2a95896104901589c495bc41460262e64ffcad5c.

Affected (1)

Products: Dena: Quicly

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dena Quicly	Before 2024-10-10

Related CWEs

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (2)

https://github.com/h2o/quicly/commit/2a95896104901589c495bc41460262e64ffcad5c

Source: security-advisories@github.com

Patch

https://github.com/h2o/quicly/security/advisories/GHSA-mp3c-h5gg-mm6p

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.