Read the docs
TI-2025-04315 Aliases CVE-2025-4820

Incorrect congestion window growth by optimistic ACK

Priority LOW 32CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support. An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames exercising an opportunistic ACK attack; see RFC 9000 Section 21.4. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support. Patches quiche 0.24.4 is the earliest version containing the fix for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00864 58th percentileScored 2026-11-07
Fix Fixed quiche (Cloudflare): 0.24.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Cloudflarequichebefore 0.24.40.24.4Patch availableCNA
  • quiche VendorCloudflare Affected before 0.24.4 Fixed in 0.24.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cloudflare:quiche:*:*:*:*:*:rust:*:*before 0.24.4VulnerableCloudflare
  • cpe:2.3:a:cloudflare:quiche:*:*:*:*:*:rust:*:* Versions before 0.24.4 Vulnerable ·Cloudflare

Remediation

  • Fix · CNA quiche (Cloudflare) Fixed in 0.24.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-4820

References

Advisory 1

  • TI-2025-06417 Infinite loop triggered by connection ID retirement CVSS 4.0HIGH 8.7
  • TI-2025-04316 Incorrect congestion window growth by invalid ACK ranges CVSS 3.1HIGH 7.5
  • TI-2026-10747 Resource exhaustion in quiche HTTP/3 and QPACK layers CVSS 3.1HIGH 7.5
  • TI-2024-01642 Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche CVSS 3.1HIGH 7.5
  • TI-2024-01317 Unbounded storage of information related to connection ID retirement, in quiche CVSS 3.1MEDIUM 5.3
  • TI-2023-05687 Unbounded queuing of path validation messages in cloudflare-quiche CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences