Quicly Denial-of-Service Vulnerability via Assertion Failures

A denial-of-service vulnerability has been identified in Quicly, an IETF QUIC protocol implementation, affecting versions prior to commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. The issue arises from improper handling of invalid QUIC frames, which can be exploited by remote attackers to trigger assertion failures, causing processes that use Quicly to crash. This disruption can affect multiple QUIC connections within a single process, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes assertion failures that crash the process using Quicly, disrupting all QUIC connections served by that process. This behavior constitutes a denial-of-service attack.

Remediation

Users can update to Quicly version 0.9.0 or later, where this vulnerability has been patched.