What’s Vulnerable › Vulnerabilities

CVE-2026-10740: Excessive memory allocation in s2n-quic

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-10 · updated 2026-10-26
• Weakness: CWE-770

Description

Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a denial of service (degraded availability) by sending crafted QUIC Initial packets. To remediate this issue, users should upgrade to v1.8.2.

Affected products

• AWS s2n-quic: through 1.8.1

References

• https://aws.amazon.com/security/security-bulletins/2026-042-aws/
• https://github.com/aws/s2n-quic/releases/tag/v1.82.0
• https://github.com/aws/s2n-quic/security/advisories/GHSA-9q54-f358-3fqf

Get alerted when CVE-2026-10740 or the next vulnerability affects your stack