CVE-2026-10740: Denial of Service in s2n-quic CryptoStream Reassembly
Vulnerability ID: CVE-2026-10740
CVSS Score: 5.3
Published: 2026-08-14
An unauthenticated Denial of Service vulnerability exists in the s2n-quic library's CryptoStream reassembler due to a lack of buffer limits on out-of-order cryptographic frames. An attacker can transmit a crafted CRYPTO frame with an extremely high offset and nominal payload, forcing the receiver to execute unbounded memory allocations and causing service crashes.
TL;DR
A zero-authentication heap allocation vulnerability in s2n-quic allows remote attackers to exhaust server memory and crash the service using a single crafted Initial packet with an excessive CRYPTO offset.
Technical Details
- CWE ID: CWE-770
- Attack Vector: Network
- CVSS Score: 5.3 (Medium)
- EPSS Score: 0.00291
- Impact: Availability (Denial of Service)
- Exploit Status: None
- KEV Status: Not Listed
Affected Systems
- s2n-quic
-
s2n-quic: < 1.82.0 (Fixed in:
1.82.0)
Code Analysis
Commit: 6c90fa9
Crypto Reassembler Buffer Fix
Commit: b493d2a
Early Connection Error Processing Fix
Commit: 4438384
Version 1.82.0 Release Chore
Mitigation Strategies
- Upgrade s2n-quic dependency to version 1.82.0 or higher.
- Implement rate limiting on incoming unauthenticated UDP Initial packets.
- Monitor server memory consumption and configure restart policies to minimize downtime.
Remediation Steps:
- Open the project's Cargo.toml file.
- Locate the s2n-quic dependency and update its version constraint to '>= 1.82.0'.
- Run 'cargo update -p s2n-quic' to pull the patched version.
- Verify the installation using 'cargo tree -p s2n-quic' to ensure no vulnerable dependencies remain.
- Rebuild and redeploy the affected applications.
References
Read the full report for CVE-2026-10740 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)