In plain language
What this advisory means
A security issue was found in s2n-quic, a Rust-built implementation of the QUIC internet protocol. When a server is set up to send Retry packets, the software might wrongly process certain connection ID lengths. This flaw allows an attacker to crash the server with just one specially crafted message. AWS services are not affected, and only certain s2n-quic server setups are vulnerable. To fix the issue, users should update to the latest s2n-quic version.
Technical explanation
How the issue affects the environment
CVE-2026-94450 affects s2n-quic versions up to 1.88.0, specifically when servers are configured to send Retry packets. The vulnerability arises from improper validation of the Destination Connection ID length in incoming QUIC Retry packets. An unauthenticated attacker can exploit this by sending a single malicious UDP datagram that triggers improper handling and causes the server endpoint to shut down, resulting in a denial of service. The fix was implemented in s2n-quic 1.89.0 by correcting this validation logic. No AWS managed services are impacted, and no workaround exists besides upgrading the software.
Operational impact
Why teams should care
If a vulnerable server endpoint configured to issue Retry packets runs s2n-quic 1.88.0 or earlier, it could be taken offline by an unauthenticated attacker, causing service disruption. Although AWS services are not affected, organizations using affected s2n-quic server configurations risk downtime, impacting availability and potentially customer trust if their applications rely on these servers.
Immediate action
Upgrade s2n-quic to version 1.89.0 or later. Ensure that any forks or derivative versions are also patched to include this fix.
Affected and fixed releases
Temporary risk reduction
No workaround is available. Upgrading to the fixed version is necessary to resolve the issue.
Evidence and validation checklist
- AWS Security Bulletin ID 2026-116-AWS published 09/22/2026
- Description confirms improper validation of Destination Connection ID length in Retry packets
- Impact: unauthenticated user can shut down server endpoint via crafted UDP datagram
- Fixed in s2n-quic version 1.89.0
- AWS services are confirmed not affected
- No workaround exists
Authoritative reference
AWS Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.