Executive brief
Cloudflare Quiche, a library used for implementing the QUIC network protocol, contained a flaw in how it handles connection identifiers when used with certain programming interfaces. If exploited, this could cause applications using the library to crash or potentially leak small amounts of internal memory. This issue only affects applications that have specifically enabled the optional Foreign Function Interface (FFI) feature.
Technical details
Two use-after-free vulnerabilities exist in the 'quiche_connection_id_iter_next' and 'quiche_conn_retired_scid_next' FFI functions. The root cause is that these functions return a pointer to a 'ConnectionId' object that is dropped (freed) at the end of the function's scope, leaving the calling application with a dangling pointer. An attacker could potentially trigger undefined behavior, leading to a denial-of-service (crash) or limited information disclosure of adjacent heap memory. The vulnerability is only present if the FFI API is enabled via a build-time feature flag. The issue is resolved in Quiche version 0.29.2.
Affected products
- Cloudflare Quiche >= 0.20.0, < 0.29.2
Timeline
- 2026-06-19: advisory
- 2026-06-19: disclosed