CVE-2024-45396: Dena Quicly DoS Vulnerability

CVE-2024-45396 Overview

CVE-2024-45396 affects Quicly, an IETF QUIC protocol implementation maintained by DeNA and used by the H2O HTTP server. The vulnerability allows a remote attacker to trigger an assertion failure that crashes any process linking the library. All Quicly versions up to commit d720707 are affected. The flaw is classified as a reachable assertion [CWE-617] and produces a denial-of-service condition on the targeted server. Maintainers addressed the issue in commit 2a95896104901589c495bc41460262e64ffcad5c, which corrects loss timer handling after a path is deleted.

Critical Impact
A remote, unauthenticated attacker can crash any service built on Quicly by sending crafted QUIC traffic, terminating active sessions and disrupting service availability.

Affected Products

DeNA Quicly (all versions up to commit d720707)
H2O HTTP server builds linking vulnerable Quicly revisions
Downstream applications embedding the Quicly QUIC library

Discovery Timeline

2024-10-11 - CVE-2024-45396 published to the National Vulnerability Database
2024-11-12 - Last updated in NVD database

Technical Details for CVE-2024-45396

Vulnerability Analysis

Quicly implements the QUIC transport protocol used to multiplex encrypted streams over UDP. The library tracks per-path state and uses assertion checks to enforce invariants on connection bookkeeping. CVE-2024-45396 stems from an unmet invariant after a path deletion operation, where the loss detection timer is not rearmed before subsequent processing references it.

A remote attacker who can reach a Quicly listener can send crafted QUIC packets that cause the library to delete a path and then continue handling the connection. Because the loss timer state is inconsistent, the process hits an assertion in lib/quicly.c and aborts. No authentication or user interaction is required, and the attack consumes minimal bandwidth.

The issue is classified as CWE-617 (Reachable Assertion). Exploitation does not yield code execution or information disclosure, but it terminates the host process, dropping all in-flight QUIC and HTTP/3 sessions.

Root Cause

The defect lives in the path management logic of lib/quicly.c. After do_delete_path() removes a path, the RTT estimate associated with the connection changes, but the send-side loss timer is not re-armed. A later code path asserts on the expected timer state and the process aborts. The fix calls setup_next_send(conn) immediately after do_delete_path() so the loss timer is consistent with the updated RTT estimate.

Attack Vector

Attackers send QUIC traffic over UDP to any listening Quicly endpoint and induce the path deletion sequence required to reach the faulty state. The remote, network-reachable nature of the bug means edge-facing HTTP/3 servers are the primary exposure.

// Patch applied in lib/quicly.c
// Source: https://github.com/h2o/quicly/commit/2a95896104901589c495bc41460262e64ffcad5c

    do_delete_path(conn, path);

+   /* rearm the loss timer, now that the RTT estimate has been changed */
+   setup_next_send(conn);

    return 0;
}

The patch rearms the send scheduler after path deletion, preventing the assertion from being reached.

Detection Methods for CVE-2024-45396

Indicators of Compromise

Unexpected SIGABRT crashes of processes linking Quicly or the H2O HTTP/3 server
Core dumps referencing assertion failures inside lib/quicly.c
Repeated short-lived QUIC connections from a single source preceding a service restart
Sudden termination of HTTP/3 sessions while TCP-based HTTP/1.1 and HTTP/2 remain available

Detection Strategies

Monitor process supervisors (systemd, runit, Kubernetes) for repeated restarts of QUIC-enabled services
Correlate UDP/443 traffic spikes with crash events in application logs
Parse core dump metadata for assertion strings originating in Quicly source files
Track QUIC connection-establishment and abnormal-termination ratios at the load balancer

Monitoring Recommendations

Enable verbose Quicly logging in non-production environments to capture path-management events
Alert on any abort or fatal signal raised by H2O or other Quicly-linked binaries
Forward crash telemetry and UDP flow records to a centralized SIEM for correlation

How to Mitigate CVE-2024-45396

Immediate Actions Required

Update Quicly to a revision that includes commit 2a95896104901589c495bc41460262e64ffcad5c or later
Rebuild and redeploy any downstream binaries, including H2O, that statically link Quicly
Inventory all hosts exposing QUIC or HTTP/3 services to confirm patch coverage
Restart affected services after deployment so the patched code is loaded

Patch Information

The maintainers fixed the issue in Quicly commit 2a95896. Additional context is available in the GitHub Security Advisory GHSA-mp3c-h5gg-mm6p. Operators should pull the latest Quicly submodule and rebuild dependent projects.

Workarounds

Disable QUIC and HTTP/3 listeners until the patched build is deployed, allowing clients to fall back to HTTP/2 over TLS
Rate-limit inbound UDP/443 traffic at upstream firewalls or load balancers to slow repeated crash attempts
Restrict QUIC exposure to known client networks where feasible

bash

# Example: temporarily disable QUIC/HTTP/3 in an H2O configuration
# Remove or comment the listen block that binds UDP for QUIC
# listen:
#   port: 443
#   type: quic
#   ssl:
#     certificate-file: /etc/h2o/server.crt
#     key-file: /etc/h2o/server.key

# Then reload H2O to apply the configuration
sudo systemctl reload h2o