What’s Vulnerable › Products

Cloudflare quiche vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your Cloudflare quiche version is affected

Latest Cloudflare quiche vulnerabilities

• CVE-2026-12707 — Unbounded path event queue growth in quiche via peer-driven source connection ID rotation (CVSS 7.5)
• CVE-2026-12523 — Resource exhaustion in quiche HTTP/3 and QPACK layers (CVSS 7.5)
• CVE-2026-11941 — Use-after-free in connection ID iterator and FFI functions (CVSS 5.6)
• CVE-2025-7054 — Infinite loop triggered by connection ID retirement (CVSS 6.5)
• CVE-2025-4821 — Incorrect congestion window growth by invalid ACK ranges (CVSS 7.5)
• CVE-2025-4820 — Incorrect congestion window growth by optimistic ACK (CVSS 5.3)
• CVE-2024-1765 — Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche (CVSS 7.5)
• CVE-2024-1410 — Unbounded storage of information related to connection ID retirement, in quiche (CVSS 5.3)
• CVE-2023-6193 — Unbounded queuing of path validation messages in cloudflare-quiche (CVSS 5.3)