A medium-severity vulnerability, identified as CVE-2026-10740 with a CVSS score of 6.9, affects s2n-quic, a Rust implementation of the QUIC protocol. An unauthenticated user can exploit this flaw by sending crafted CRYPTO frames with high offsets to an s2n-quic endpoint, causing excessive memory allocation and potentially leading to denial-of-service due to repeated memory pressure. The buffer used for processing these frames does not enforce a maximum size, resulting in approximately 9.4 MB of allocation per packet. This issue is exacerbated by the fact that no valid handshake is required to exploit this vulnerability. Impacted versions of s2n-quic are less than or equal to v1.81.0.
We recommend you to update s2n-quic to version 1.82.0.[/subscribe_to_unlock_form]
A medium-severity vulnerability, identified as CVE-2026-10740 with a CVSS score of 6.9, affects s2n-quic, a Rust implementation of the QUIC protocol. An unauthenticated user can exploit this flaw by sending crafted CRYPTO frames with high offsets to an s2n-quic endpoint, causing excessive memory allocation and potentially leading to denial-of-service due to repeated memory pressure. The buffer used for processing these frames does not enforce a maximum size, resulting in approximately 9.4 MB of allocation per packet. This issue is exacerbated by the fact that no valid handshake is required to exploit this vulnerability. Impacted versions of s2n-quic are less than or equal to v1.81.0.
We recommend you to update s2n-quic to version 1.82.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]