{"id":"CVE-2026-10740","aliases":["GHSA-9q54-f358-3fqf"],"title":"s2n-quic has excessive memory allocation","summary":"s2n-quic has excessive memory allocation","severity":"medium","cvss":5.3,"cwe":["CWE-770"],"vendor":"s2n-quic","product":"s2n-quic","ecosystem":"rust","affected":["s2n-quic <= 1.81.0"],"patched":["s2n-quic 1.82.0"],"published":"2026-08-14","updated":"2026-08-14","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-9q54-f358-3fqf","references":[{"url":"https://github.com/aws/s2n-quic/security/advisories/GHSA-9q54-f358-3fqf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10740"},{"url":"https://aws.amazon.com/security/security-bulletins/2026-042-aws"},{"url":"https://github.com/aws/s2n-quic/releases/tag/v1.82.0"},{"url":"https://github.com/advisories/GHSA-9q54-f358-3fqf"}],"tags":["ghsa","rust"],"epss":0.00291,"epssPercentile":0.21974,"ingestedAt":"2026-08-14T22:21:25.677Z","slug":"CVE-2026-10740","body":"## Overview\n\ns2n-quic is a Rust implementation of the QUIC protocol. An unauthenticated user can attempt to exhaust server memory on an s2n-quic endpoint by sending crafted CRYPTO frames with high offsets. The buffer used for processing CRYPTO frames does not enforce a maximum size. In the worst case, a single 1200-byte packet can cause approximately 9.4 MB of allocation. By repeatedly sending such packets, the resulting memory pressure could cause denial of service. No valid handshake is required.\n\nImpacted versions: <= v1.81.0\n\n### Patches\nThis issue has been addressed in s2n-quic version v1.82.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n\n### Workarounds\nThere is no workaround that fully mitigates this issue. Upgrading to the patched version is the recommended remediation.\n\n### References\nIf there are any questions or comments about this advisory, contact AWS Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n## Affected packages\n\n- `s2n-quic <= 1.81.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `s2n-quic 1.82.0`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}