Cloudflare quiche Unbounded PathEvent Queue DoS via Peer-Driven Source Connection ID Rotation (CVE-2026-12707)

Vulnerability Overview Cloudflare quiche has an unbounded path event queue growth vulnerability, which causes memory resource exhaustion through peer-driven source connection ID rotation. Affected Versions Affected Versions: >= 0.15.0 Fixed Version: 0.29.3 Remediation Upgrade to quiche 0.29.3 or later to fix this vulnerability. Detailed Description Cloudflare quiche was found to have a memory resource exhaustion vulnerability caused by unbounded growth of the path event queue. quiche supports the connection migration functionality described in Section 9 of RFC 9000, allowing a single QUIC connection to survive network path changes. Although quiche implements mitigation measures to limit server state commitment as described in Section 9.3 of RFC 9000, it was found that the collection of PathEvents (intended to be consumed by the application via the function) was not bounded. Once the QUIC handshake is complete, peers can exploit rapid source address migration to cause unbounded queuing of types. The server remains vulnerable even if active connection migration is disabled. quiche 0.29.3 is the earliest version containing the fix for this vulnerability. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High CVSS Score: 7.5 / 10 CVE ID: CVE-2026-12707 Weaknesses: No CWE Credit: LPardue (Fix Developer)

Goal Reached Thanks to every supporter — we hit 100%!

Cloudflare quiche Unbounded PathEvent Queue DoS via Peer-Driven Source Connection ID Rotation (CVE-2026-12707)

More from this source