Quick answers
- Is CVE-2026-11941 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-11941 being exploited in the wild.
- How severe is CVE-2026-11941?
- Medium severity, with a CVSS score of 5.6, published 19 June 2026.
- Which products and versions are affected?
- quiche (crates.io) >= 0.20.0, < 0.29.2, SEMVER:introduced=0.20.0,fixed=0.29.2.
- Is there a fix for CVE-2026-11941?
- Yes. quiche (crates.io): upgrade to 0.29.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-11941 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-11941?
- Check whether you run quiche (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- quiche (crates.io): upgrade to 0.29.2 or later
cargo update -p quiche
Technical details
Two use-after-free vulnerabilities exist in the 'quiche_connection_id_iter_next' and 'quiche_conn_retired_scid_next' FFI functions. The root cause is that these functions return a pointer to a 'ConnectionId' object that is dropped (freed) at the end of the function's scope, leaving the calling application with a dangling pointer. An attacker could potentially trigger undefined behavior, leading to a denial-of-service (crash) or limited information disclosure of adjacent heap memory. The vulnerability is only present if the FFI API is enabled via a build-time feature flag. The issue is resolved in Quiche version 0.29.2.
Affected products
- Cloudflare Quiche >= 0.20.0, < 0.29.2
Identifiers
- CVE-2026-11941
- GHSA-mh64-ph39-mrc9
Timeline
- 2026-06-19: advisory
- 2026-06-19: disclosed