CVE-2025-7054 Infinite loop triggered by connection ID retirement

Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRECONNECTIONID frames. QUIC connections possess a set of connection identifiers IDs; see Section 5.1 of RFC 9000 https://datatracker.ietf.org/doc/html/rfc9000section-5.1 . Once the QUIC...

CVE-2025-7054

The CVE-2025-7054 entry concerns Cloudflare’s quiche QUIC/TLS library, where an unauthenticated attacker can trigger an infinite loop by sending RETIRE_CONNECTION_ID frames. The issue arises from how retirement across paths can synchronize multiple active connection IDs, allowing a retirement fra...

CBL Mariner 2.0 Security Update: mysql (CVE-2025-5025)

The version of mysql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-5025 advisory. - libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this...

PT-2025-32266 · Cloudflare · Cloudflare Quiche

Name of the Vulnerable Software and Affected Versions: Cloudflare quiche versions 0.15.0 through 0.24.5 Description: Cloudflare quiche is susceptible to an infinite loop when processing packets containing RETIRE CONNECTION ID frames. QUIC connections utilize connection identifiers IDs with sequen...

CVE-2025-54939

LiteSpeed QUIC LSQUIC Library before 4.3.1 has an lsquicenginepacketin memory leak...

CVE-2025-54939

LiteSpeed QUIC LSQUIC Library before 4.3.1 has an lsquicenginepacketin memory leak...

CVE-2025-54939

CVE-2025-54939 affects the LiteSpeed QUIC (LSQUIC) Library prior to 4.3.1, where a memory leak in the lsquic_engine_packet_in path can cause linear memory growth and potential DoS. The vulnerability is triggered by mis-handling coalesced QUIC Initial packets before a handshake, leading to memory ...

CVE-2025-54939

LiteSpeed QUIC LSQUIC Library before 4.3.1 has an lsquicenginepacketin memory leak...

PT-2025-31606 · Litespeed · Litespeed Quic

Name of the Vulnerable Software and Affected Versions: LiteSpeed QUIC LSQUIC Library versions prior to 4.3.1 Description: The LiteSpeed QUIC LSQUIC Library contains a memory leak in the lsquic engine packet in function. Recommendations: Update to LiteSpeed QUIC LSQUIC Library version 4.3.1 or lat...

Litespeed Technologie LiteSpeed QUIC 安全漏洞

Litespeed Technologie LiteSpeed QUIC LSQUIC is an open source implementation of QUIC and HTTP/3 functionality for servers and clients from Litespeed Technologie, USA. A security vulnerability exists in Litespeed Technologie LiteSpeed QUIC versions prior to 4.3.1, which stems from a memory leak in...

CVE-2025-54939

LiteSpeed QUIC LSQUIC Library before 4.3.1 has an lsquicenginepacketin memory leak...

CVE-2025-54939

LiteSpeed QUIC LSQUIC Library before 4.3.1 has an lsquicenginepacketin memory leak...

K000152723: Golang crypto/tls vulnerabilities CVE-2023-39321 and CVE-2023-39322

Security Advisory Description CVE-2023-39321 Processing an incomplete post-handshake message for a QUIC connection can cause a panic. CVE-2023-39322 QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection...

CVE-2025-30403

A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00...

CVE-2025-30403

CVE-2025-30403 affects mvfst, where a heap-buffer-overflow can be triggered by a specially crafted QUIC message. Affected versions are mvfst prior to v2025.07.07.00. The issue stems from how mvfst handles certain input during QUIC sessions, potentially enabling a crash or memory corruption. Publi...

CVE-2025-30403

A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00...

CVE-2025-30403

A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00...

CVE-2025-30403

A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00...

mvfst 安全漏洞

mvfst is a Meta open source client and server-side implementation of the IETF QUIC protocol. A security vulnerability exists in versions prior to mvfst v2025.07.07.00 that stems from a heap buffer overflow that can be caused by a specially crafted message in a QUIC session...

PT-2025-29273 · Mvfst · Mvfst

Name of the Vulnerable Software and Affected Versions: mvfst versions prior to v2025.07.07.00 Description: A heap-buffer-overflow vulnerability exists in mvfst. This issue occurs when processing a specially crafted message during a QUIC session. Recommendations: Update mvfst to version...