# CVE-2026-12708: Cloudflare tokio-quiche uncontrolled resource consumption in HTTP/3 DATAGRAM

Source: https://junglewise.ai/threats/cve-2026-12708-summary-cloudflare-tokio-quiche-was-found-to-contain-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-12708 · Severity: info · Published 2026-11-10

Cloudflare's tokio-quiche is a QUIC protocol library used in network communication. A flaw in its HTTP/3 DATAGRAM handling allows remote attackers to exhaust server or client memory by sending crafted packets with many distinct identifiers, causing a denial-of-service outage. The vulnerability affects both client and server deployments when DATAGRAM support is enabled.

Vendors: [Cloudflare](https://junglewise.ai/threats/vendors/cloudflare).

## Quick answers

**Is CVE-2026-12708 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12708 being exploited in the wild.

**How severe is CVE-2026-12708?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Cloudflare Tokio-Quiche <= 0.20.1.

**Is there a fix for CVE-2026-12708?** Yes: fixed in tokio-quiche 0.23.0. Until then: Disable DATAGRAM support by setting QuicSettings::enable_dgram to false in tokio-quiche configuration until an upgrade to version 0.23.0 or later is possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12708 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-12708?** Check whether you run Cloudflare Tokio-Quiche at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in tokio-quiche 0.23.0

Disable DATAGRAM support by setting QuicSettings::enable_dgram to false in tokio-quiche configuration until an upgrade to version 0.23.0 or later is possible.

## Technical details

An uncontrolled resource consumption vulnerability exists in tokio-quiche's HTTP/3 DATAGRAM frame handling: for each previously unseen flow identifier (quarter stream ID), the library creates unbounded per-flow state entries that are never cleaned up, allowing a remote peer to exhaust process memory. The vulnerable code path requires DATAGRAM support to be negotiated and enabled via QuicSettings::enable_dgram. The fix in version 0.23.0 bounds flow state creation to valid DATAGRAM-capable request streams and implements an expiring buffer for early arrivals.

## Affected products

- Cloudflare tokio-quiche <= 0.20.1

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/cloudflare/quiche/security/advisories/GHSA-wcm9-jv39-r963](https://github.com/cloudflare/quiche/security/advisories/GHSA-wcm9-jv39-r963)
- [https://www.cve.org/CVERecord?id=CVE-2026-12708](https://www.cve.org/CVERecord?id=CVE-2026-12708)