Unbounded queuing of path validation messages in cloudflare-quiche
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path validation (RFC 9000 Section 8.2) requires that the recipient of a PATH_CHALLENGE frame responds by sending a PATH_RESPONSE. An unauthenticated remote attacker can exploit the vulnerability by sending PATH_CHALLENGE frames and manipulating the connection (e.g. by restricting the peer's congestion window size) so that PATH_RESPONSE frames can only be sent at the slower rate than they are received; leading to storage of path validation data in an unbounded queue. Quiche versions greater than 0.19.0 address this problem.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cloudflare | quiche | 0.15.0 – 0.19.0 | — | No fix listed | CNA |
| — | quiche (crates.io) | 0.15.0 to before 0.19.1 | 0.19.1 | Patch available | GHSA-w3vp-jw9m-f9pm |
- quiche VendorCloudflare Affected 0.15.0 – 0.19.0 Fixed in — No fix listed CNA
- quiche (crates.io) Vendor— Affected 0.15.0 to before 0.19.1 Fixed in 0.19.1 Patch available GHSA-w3vp-jw9m-f9pm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudflare:quiche:*:*:*:*:*:*:*:* | 0.15.0 – 0.19.0 | Vulnerable | Cloudflare |
- cpe:2.3:a:cloudflare:quiche:*:*:*:*:*:*:*:* Versions 0.15.0 – 0.19.0 Vulnerable ·Cloudflare
Remediation
- Fix · GHSA-w3vp-jw9m-f9pm quiche (crates.io) Fixed in 0.19.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6193
- 2026-10-03 Alias added: GHSA-w3vp-jw9m-f9pm
References
Advisory 2
More Cloudflare Quiche vulnerabilities
- TI-2025-06417 Infinite loop triggered by connection ID retirement CVSS 4.0HIGH 8.7
- TI-2025-04316 Incorrect congestion window growth by invalid ACK ranges CVSS 3.1HIGH 7.5
- TI-2026-10747 Resource exhaustion in quiche HTTP/3 and QPACK layers CVSS 3.1HIGH 7.5
- TI-2024-01642 Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche CVSS 3.1HIGH 7.5
- TI-2025-04315 Incorrect congestion window growth by optimistic ACK CVSS 3.1MEDIUM 5.3
- TI-2024-01317 Unbounded storage of information related to connection ID retirement, in quiche CVSS 3.1MEDIUM 5.3
Sources
- CVE-2023-6193 · CVE Program
- CVE-2023-6193 · NVD
- FIRST EPSS
- GHSA-w3vp-jw9m-f9pm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences