CVE-2026-10740

Medium

Description

Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a denial of service (degraded availability) by sending crafted QUIC Initial packets. To remediate this issue, users should upgrade to v1.8.2.

SeverityMedium

CVSS5.3

Exploit probability—

ProductAws S2n-quic

PublishedJun 10, 2026

First seenJun 10, 2026

Weakness typeCWE-770Allocation of resources without limits

How to fix

Patches

github.com/aws/s2n-quic/releases/tag/v1.82.0

Vendor advisories

aws.amazon.com/security/security-bulletins/2026-042-aws/

Affected products

Product	Affected versions	Fixed in
AWS s2n-quic	v ≤ 1.8.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.