Back to Database
Status published
High
CVE-2024-45396
Quicly assertion failures
Vulnerability Description
Quicly is an IETF QUIC protocol implementation. Quicly up to commtit d720707 is susceptible to a denial-of-service attack. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using quicly. The vulnerability is addressed with commit 2a95896104901589c495bc41460262e64ffcad5c.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-45396
Credits & Attribution
No credits recorded in the NVD database.
References
More from h2o
View All →CVE-2025-61684
Quicly has assertion failures
High
7.5
CVE-2024-45403
H2O assertion failure when HTTP/3 requests are cancelled
Low
3.7
CVE-2024-45402
Picotls double free
High
8.6
CVE-2024-45397
H2O alllows bypassing address-based access control with 0-RTT
Medium
5.9
CVE-2024-25622
H2O ignores headers configuration directives
Low
3.1
Affected Vendor
Affected Software
quicly
Vulnerable Versions:
< 2a95896104901589c495bc41460262e64ffcad5c
Timeline
Official Publish:
October 11th, 2024
Last Modified:
October 15th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H