CVE-2024-1410

CVE-2024-1410 affects Cloudflare quiche, an open-source QUIC implementation. The issue is unbounded storage of information related to connection ID retirement, where an unauthenticated attacker can cause RETIRE_CONNECTION_ID frames to arrive faster than they can be retired, potentially overflowin...

CVE-2024-1765

Cloudflare Quiche (up to 0.19.1/0.20.0) contains an unlimited resource allocation vulnerability where an attacker floods QUIC CRYPTO frames (1-RTT) after the QUIC handshake, causing rapid memory usage growth on the affected system. The issue affects both server and client implementations and coul...

CVE-2025-4821

CVE-2025-4821 affects Cloudflare’s quiche (QUIC) prior to 0.24.4. The issue is “Incorrect congestion window growth” caused by processing invalid ACK ranges. An unauthenticated remote attacker can complete a handshake, initiate a congestion-controlled transfer, and send ACK frames covering a large...

CVE-2025-4820

CVE-2025-4020 (CVE-2025-4820) affects the Cloudflare quiche library. The issue is an incorrect congestion window growth caused by an opportunistic ACK attack (RFC 9000, §21.4) that can allow a victim to send more data in flight than the path supports. An unauthenticated remote attacker can comple...