Executive brief
Cloudflare quiche, a library used to implement the QUIC network protocol, is vulnerable to a denial-of-service attack. An attacker can repeatedly trigger network path changes that cause the server to consume excessive amounts of memory, eventually leading to a crash or system instability. This issue affects servers even if they have connection migration features disabled, potentially impacting service availability for all users.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in Cloudflare quiche due to the unbounded queuing of PathEvents. While quiche implements RFC 9000 Section 9.3 protections to limit server state commitment, the internal collection of PathEvents intended for application consumption via path_event_next() was not bounded. A remote, unauthenticated attacker can exploit this after a QUIC handshake by performing rapid source address migration, leading to an unbounded queue of PathEvent::ReusedSourceConnectionId types. This consumes system memory until exhaustion occurs. The vulnerability exists even if active connection migration is disabled. A fix is available in version 0.29.3.
Affected products
- Cloudflare quiche >= 0.15.0, < 0.29.3
Timeline
- 2026-07-14: advisory
- 2026-07-14: patched: Fixed in version 0.29.3