---
id: CVE-2026-10740
aliases:
  - GHSA-9q54-f358-3fqf
title: s2n-quic has excessive memory allocation
summary: s2n-quic has excessive memory allocation
severity: medium
cvss: 5.3
cwe:
  - CWE-770
vendor: s2n-quic
product: s2n-quic
ecosystem: rust
affected:
  - s2n-quic <= 1.81.0
patched:
  - s2n-quic 1.82.0
published: '2026-08-14'
updated: '2026-08-14'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-9q54-f358-3fqf'
references:
  - url: 'https://github.com/aws/s2n-quic/security/advisories/GHSA-9q54-f358-3fqf'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-10740'
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-042-aws'
  - url: 'https://github.com/aws/s2n-quic/releases/tag/v1.82.0'
  - url: 'https://github.com/advisories/GHSA-9q54-f358-3fqf'
tags:
  - ghsa
  - rust
epss: 0.00291
epssPercentile: 0.19281
ingestedAt: '2026-08-14T22:21:25.677Z'
---

## Overview

s2n-quic is a Rust implementation of the QUIC protocol. An unauthenticated user can attempt to exhaust server memory on an s2n-quic endpoint by sending crafted CRYPTO frames with high offsets. The buffer used for processing CRYPTO frames does not enforce a maximum size. In the worst case, a single 1200-byte packet can cause approximately 9.4 MB of allocation. By repeatedly sending such packets, the resulting memory pressure could cause denial of service. No valid handshake is required.

Impacted versions: <= v1.81.0

### Patches
This issue has been addressed in s2n-quic version v1.82.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. 

### Workarounds
There is no workaround that fully mitigates this issue. Upgrading to the patched version is the recommended remediation.

### References
If there are any questions or comments about this advisory, contact AWS Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.

## Affected packages

- `s2n-quic <= 1.81.0`

## Remediation

Upgrade to a patched release:

- `s2n-quic 1.82.0`