Priority MEDIUM 40
Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames.
Vulnerabilities
7 records
TI-2025-06417 CVE-2025-7054 · GHSA-m3hh-f9gh-74c2
Infinite loop triggered by connection ID retirement
Priority MEDIUM 44
Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_CONNECTION_ID frames.
Priority MEDIUM 41
Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.
Priority LOW 32
Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.
TI-2024-01317 CVE-2024-1410 · GHSA-xhg9-xwch-vr7x
Unbounded storage of information related to connection ID retirement, in quiche
Priority LOW 25
Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption.
TI-2024-01642 CVE-2024-1765 · GHSA-78wx-jg4j-5j6g
Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche
Priority LOW 35
Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client.
TI-2023-05687 CVE-2023-6193 · GHSA-w3vp-jw9m-f9pm
Unbounded queuing of path validation messages in cloudflare-quiche
Priority LOW 25
quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption.