medium5.3
CVE-2026-10740
Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a denial of service (de…
Impact
Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a denial of service (degraded availability) by sending crafted QUIC Initial packets. To remediate this issue, users should upgrade to v1.8.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | s2n-quic | <= 1.81.0 | 1.82.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-9q54-f358-3fqf
- https://github.com/aws/s2n-quic/security/advisories/GHSA-9q54-f358-3fqf
- https://nvd.nist.gov/vuln/detail/CVE-2026-10740
- https://aws.amazon.com/security/security-bulletins/2026-042-aws
- https://github.com/aws/s2n-quic/releases/tag/v1.82.0
- https://aws.amazon.com/security/security-bulletins/2026-042-aws/