Read the docs
TI-2026-10298 Aliases CVE-2026-11941GHSA-mh64-ph39-mrc9

Use-after-free in connection ID iterator and FFI functions

Priority LOW 25CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions. The “quiche_connection_id_iter_next” and “quiche_conn_retired_scid_next” functions would return a pointer to a “ConnectionId” to the applications via function arguments, but the owned “ConnectionId” would be dropped at the end of those functions' scope. Only applications using those FFI functions are affected. The FFI API is disabled by default by a build-time feature flag. Impact If unpatched, an application calling the affected FFI functions will dereference freed memory. The most likely outcome is undefined behavior leading to a process crash (denial of service). Depending on allocator state, the read may also return adjacent heap contents, resulting in limited information disclosure or incorrect connection identifier handling. Mitigation Users are requested to upgrade to quiche 0.29.2 which is the earliest version containing the fix for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Fix Fixed quiche (crates.io): 0.29.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CloudflareQuiche0.20.0 – 0.29.1—No fix listedCNA
—quiche (crates.io)0.20.0 to before 0.29.20.29.2Patch availableGHSA-mh64-ph39-mrc9
  • Quiche VendorCloudflare Affected 0.20.0 – 0.29.1 Fixed in — No fix listed CNA
  • quiche (crates.io) Vendor— Affected 0.20.0 to before 0.29.2 Fixed in 0.29.2 Patch available GHSA-mh64-ph39-mrc9

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:cloudflare:quiche:*:*:*:*:*:*:*:*——Cloudflare
  • cpe:2.3:a:cloudflare:quiche:*:*:*:*:*:*:*:* Versions — — ·Cloudflare

Remediation

  • Fix · GHSA-mh64-ph39-mrc9 quiche (crates.io) Fixed in 0.29.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11941
  2. 2026-10-03 Alias added: GHSA-mh64-ph39-mrc9

References

Advisory 1

Other 2

  • TI-2026-12208 Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records CVSS 4.0HIGH 7.6
  • TI-2025-36979 Cloudflare vite plugin exposes secrets over the built-in dev server CVSS 4.0LOW 2.9
  • TI-2014-08329 Out-of-bounds write in github.com/cloudflare/golz4 CVSS 3.1CRITICAL 9.8
  • TI-2021-02817 Arbitrary filepath traversal via URI injection CVSS 3.1CRITICAL 9.8
  • TI-2023-02843 Out of Bounds Slice index in cfnts leads to remote panic CVSS 3.1HIGH 8.6
  • TI-2026-02435 HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing CVSS 4.0CRITICAL 9.3
See all 69 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences