CVE-2024-45396

EUVD-2024-41457
Quicly is an IETF QUIC protocol implementation. Quicly up to commtit d720707 is susceptible to a denial-of-service attack. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using quicly. The vulnerability is addressed with commit 2a95896104901589c495bc41460262e64ffcad5c.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 77%
Affected Products (NVD)
VendorProductVersion
denaquicly
𝑥
< 2024-10-10
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
h2o_projectquicly
𝑥
< 2a95896104901589c495bc41460262e64ffcad5c
ADP
Common Weakness Enumeration
References
https://github.com/h2o/quicly/commit/2a95896104901589c495bc41460262e64ffcad5c
https://github.com/h2o/quicly/security/advisories/GHSA-mp3c-h5gg-mm6p