Executive brief
Cloudflare quiche, a library used to implement the modern HTTP/3 web protocol, is vulnerable to a memory exhaustion flaw. An attacker can send specially crafted web traffic that forces the server to allocate excessive amounts of memory, potentially leading to a system crash or service outage. This impacts the availability of any web services or applications relying on the affected library.
Technical details
Cloudflare quiche's HTTP/3 layer contains two memory exhaustion vulnerabilities. First, the library pre-allocates memory based on the declared length in certain HTTP/3 frame headers before receiving the actual payload, allowing an attacker to trigger large allocations without sending the corresponding data. Second, the library fails to correctly enforce QPACK decompression limits, specifically ignoring the MAX_FIELD_SECTION_SIZE configuration when processing HEADERS frames. These flaws allow a remote, unauthenticated attacker to exhaust system memory via the network. The issue is resolved in quiche version 0.29.3.
Affected products
- Cloudflare quiche >= 0.1.0, < 0.29.3
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory
- 2026-07-14: patched: Fixed in version 0.29.3