OCTOBER 10, 2026
Live Feed
Back to database
Case File

CVE-2026-94450

HIGH · CVSS 7.5 EPSS 1.94% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-22 · Last synced 2026-10-10

CyberRota Analysis

AI-Generated

Improper validation of the Destination Connection ID length in s2n-quic versions 1.88.0 and earlier can be exploited by unauthenticated remote users to trigger a denial of service, potentially shutting down affected server endpoints that are configured to send Retry packets. Organizations using these versions should prioritize upgrading to version 1.89.0 or later to mitigate this vulnerability and maintain service availability.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-94450
Severity
HIGH
CVSS
7.5
EPSS
1.94%

Original NVD Description

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected. To remediate this issue, users should upgrade to version v1.89.0 or later.