{"id":"EUVD-2026-36103","enisaUuid":"b149603a-db04-3d24-be18-292de67c5d4a","description":"Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a denial of service (degraded availability) by sending crafted QUIC Initial packets.\n\n\n\nTo remediate this issue, users should upgrade to v1.8.2.","datePublished":"Jun 10, 2026, 6:09:36 PM","dateUpdated":"Jun 10, 2026, 7:14:59 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/aws/s2n-quic/releases/tag/v1.82.0\nhttps://aws.amazon.com/security/security-bulletins/2026-042-aws/\nhttps://github.com/aws/s2n-quic/security/advisories/GHSA-9q54-f358-3fqf\n","aliases":"CVE-2026-10740\nGHSA-9q54-f358-3fqf\n","assigner":"AMZN","epss":0.29,"enisaIdProduct":[{"id":"507ae592-f491-3d6b-af09-9b5c9d49f631","product":{"name":"s2n-quic","vendor":{"name":"aws"}},"product_version":"0 ≤1.8.1"}],"enisaIdVendor":[{"id":"ed508f0e-ee99-31c4-bc6c-2d346aaf5ca2","vendor":{"name":"aws"}}],"enisaIdVulnerability":[{"id":"55ebd35e-931d-3f98-8741-d4205444b5e7","vulnerability":{"id":"GHSA-9q54-f358-3fqf","description":"s2n-quic has excessive memory allocation","datePublished":"Aug 14, 2026, 9:44:19 PM","dateUpdated":"Aug 14, 2026, 9:44:19 PM","baseScore":0.0,"references":"https://github.com/aws/s2n-quic/security/advisories/GHSA-9q54-f358-3fqf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-10740\nhttps://aws.amazon.com/security/security-bulletins/2026-042-aws\nhttps://github.com/aws/s2n-quic\nhttps://github.com/aws/s2n-quic/releases/tag/v1.82.0\n","enisa_id":"EUVD-2026-36103\n","aliases":"GHSA-9q54-f358-3fqf\nCVE-2026-10740\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"7514f212-238c-3d3f-85f2-896ec96e2dc9","vulnerability":{"id":"CVE-2026-10740","description":"Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a denial of service (degraded availability) by sending crafted QUIC Initial packets.\n\n\n\nTo remediate this issue, users should upgrade to v1.8.2.","datePublished":"Jun 10, 2026, 6:09:36 PM","dateUpdated":"Jun 10, 2026, 7:14:59 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/aws/s2n-quic/releases/tag/v1.82.0\nhttps://aws.amazon.com/security/security-bulletins/2026-042-aws/\nhttps://github.com/aws/s2n-quic/security/advisories/GHSA-9q54-f358-3fqf\n","enisa_id":"EUVD-2026-36103\n","assigner":"AMZN","epss":0.29,"dataProcessed":"Nov 1, 2026, 4:03:01 AM","vulnerabilityProduct":[{"id":"146f4f4c-4efe-33a6-aec9-636c05b4e091","product":{"name":"s2n-quic","vendor":{"name":"aws"}},"product_version":"0 ≤1.8.1"}],"vulnerabilityVendor":[{"id":"ff9cd40f-cfd8-39c8-9415-4bc380ff927a","vendor":{"name":"aws"}}]}}],"enisaIdAdvisory":[]}