Back to Database
Status published
High
CVE-2025-61684
Quicly has assertion failures
Vulnerability Description
Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using Quicly. Commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e fixes the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-61684
Credits & Attribution
No credits recorded in the NVD database.
References
More from h2o
View All →CVE-2024-45403
H2O assertion failure when HTTP/3 requests are cancelled
Low
3.7
CVE-2024-45402
Picotls double free
High
8.6
CVE-2024-45397
H2O alllows bypassing address-based access control with 0-RTT
Medium
5.9
CVE-2024-45396
Quicly assertion failures
High
7.5
CVE-2024-25622
H2O ignores headers configuration directives
Low
3.1
Affected Vendor
Affected Software
quicly
Vulnerable Versions:
< d9d3df6
Timeline
Official Publish:
January 19th, 2026
Last Modified:
January 20th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H