Potential denial of service when configured to send Retry packets in s2n-quic
UnratedCVE-2026-94450 · Published Sep 22, 2026
Bulletin ID: 2026-116-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/22/2026 13:00 PM PDT Description: s2n-quic is a Rust implementation of the QUIC protocol. We identified CVE-2026-94450, an issue with improper validation of the Destination Connection ID length when a server is configured to send Retry packets. s2n-quic 1.88.0 and earlier allow an unauthenticated user to shut down a server endpoint via a single crafted UDP datagram. No AWS services are affected by this issue, and customers of AWS services do not need to take action. Only server endpoints specifically configured to issue Retry packets are affected. Impacted versions: <= v1.88.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected versions
Details and references
- Severity from
- no source yet
More AWS advisories
All AWS| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 22 | Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths High8.8Sep 22 | High8.8 | No fix yet |
| Sep 22 | Amazon Aurora PostgreSQL a fully managed relational database engine that's compatible...High8.0Sep 22 | High8.0 | No fix yet |
| Sep 22 | HTTPS Fallback to HTTP in Graph ExplorerMedium5.9Sep 22 | Medium5.9 | No fix yet |
| Sep 22 | Code Injection via Improper Triple-Quote Escaping in AgentCore CLI Bedrock Agent ImportCritical9.0Sep 22 | Critical9.0 | No fix yet |
| Sep 22 | Issue with HTTP/2 multi-frame request body inspection in AWS WAFCritical9.8Sep 22 | Critical9.8 | No fix yet |
| Sep 22 | Authenticated SQL injection in the metrics-service retention policy subsystem of...High8.1Sep 22 | High8.1 | No fix yet |