CVE-2026-9545: exposing HTTP/3 early data

Summary:

When the ngtcp2 HTTP/3 backend reuses a TLS session that advertises early data support, cf_ngtcp2_on_session_reuse() initializes the HTTP/3 connection state and marks the connection filter as connected before the new QUIC/TLS handshake has completed. The request send path can then reach cf_ngtcp2_send() while peer verification for the new connection is still pending. cf_ngtcp2_send() checks ctx->tls_vrfy_result only at function entry, then can process ingress, open an HTTP/3 stream, buffer request bytes, and flush egress without requiring that the peer has already been verified.

• cf_ngtcp2_send(): the ngtcp2 send path rejects only a preexisting verification error. It does not require ctx->tls_handshake_complete or a successful peer verification before opening an HTTP/3 stream, buffering request bytes, or flushing egress.

  /* handshake verification failed in callback, do not send anything */
  if(ctx->tls_vrfy_result) {
    result = ctx->tls_vrfy_result;
    goto denied;