Aws s2n-Quic vulnerabilities

2 CVEs affecting Aws s2n-Quic, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-94450, published 2026-09-22.

More from Aws.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-94450, published 2026-09-22. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via…
• CVE-2026-10740, published 2026-06-10. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a denial of service (degraded availability) by sending crafted…