# CVE-2026-11941: Cloudflare Quiche use-after-free in connection ID iterator FFI functions

Source: https://junglewise.ai/threats/cve-2026-11941-cloudflare-quiche-use-after-free-in-connection-id-iterator-ffi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-11941 · Severity: medium · CVSS 5.6 · Published 2026-06-19

Cloudflare Quiche, a library used for implementing the QUIC network protocol, contained a flaw in how it handles connection identifiers when used with certain programming interfaces. If exploited, this could cause applications using the library to crash or potentially leak small amounts of internal memory. This issue only affects applications that have specifically enabled the optional Foreign Function Interface (FFI) feature.

Technologies: [quiche (crates.io)](https://junglewise.ai/threats/technologies/quiche). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-11941 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11941 being exploited in the wild.

**How severe is CVE-2026-11941?** Medium severity, with a CVSS score of 5.6, published 19 June 2026.

**Which products and versions are affected?** quiche (crates.io) >= 0.20.0, < 0.29.2, SEMVER:introduced=0.20.0,fixed=0.29.2.

**Is there a fix for CVE-2026-11941?** Yes. quiche (crates.io): upgrade to 0.29.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11941 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11941?** Check whether you run quiche (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- quiche (crates.io): upgrade to 0.29.2 or later

  ```sh
  cargo update -p quiche
  ```


## Technical details

Two use-after-free vulnerabilities exist in the 'quiche_connection_id_iter_next' and 'quiche_conn_retired_scid_next' FFI functions. The root cause is that these functions return a pointer to a 'ConnectionId' object that is dropped (freed) at the end of the function's scope, leaving the calling application with a dangling pointer. An attacker could potentially trigger undefined behavior, leading to a denial-of-service (crash) or limited information disclosure of adjacent heap memory. The vulnerability is only present if the FFI API is enabled via a build-time feature flag. The issue is resolved in Quiche version 0.29.2.

## Affected products

- Cloudflare Quiche >= 0.20.0, < 0.29.2

## Identifiers

- CVE-2026-11941
- GHSA-mh64-ph39-mrc9

## Timeline

- 2026-06-19: advisory
- 2026-06-19: disclosed

## References

- [https://github.com/cloudflare/quiche/security/advisories/GHSA-mh64-ph39-mrc9](https://github.com/cloudflare/quiche/security/advisories/GHSA-mh64-ph39-mrc9)

## Related threats

- [quiche connection ID retirement can trigger an infinite loop](https://junglewise.ai/threats/cve-2025-7054-quiche-connection-id-retirement-can-trigger-an-infinite-loop)
- [quiche vulnerable to unlimited resource allocation by QUIC CRYPTO frames flooding](https://junglewise.ai/threats/cve-2024-1765-quiche-vulnerable-to-unlimited-resource-allocation-by-quic-crypto)
- [quiche vulnerable to unbounded storage of information related to connection ID retirement](https://junglewise.ai/threats/cve-2024-1410-quiche-vulnerable-to-unbounded-storage-of-information-related-to)
- [Unbounded queuing of path validation messages in cloudflare-quiche](https://junglewise.ai/threats/cve-2023-6193-unbounded-queuing-of-path-validation-messages-in-cloudflare-quiche)