CVE-2026-12523

HighCVSS 7.5

Published: 14/07/2026(UTC)Updated: 06/08/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

Cloudflare quiche's HTTP/3 layer is vulnerable to resource exhaustion (memory) via specially crafted HTTP/3 frames. Pre-allocation of memory based on declared frame length can be triggered without sending the full payload. Additionally, incorrect QPACK decompression limits allow memory commitment beyond advertised MAX_FIELD_SECTION_SIZE.

Risk Assessment

An attacker can exhaust server memory, causing denial of service (DoS) and potentially destabilizing applications using quiche.

Recommendation

Upgrade quiche to version 0.29.3 or later, which contains the fix for this vulnerability.

Other vulnerabilities in quiche

CVE-2026-12707High
Cloudflare quiche was found vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events. An attacker can exploit rapid source address migration to cause unbounded queuing of PathEvent::ReusedSourceConnectionId events, even if active connection migration is disabled.

Original NVD description (English source)

Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. Impact HTTP/3 defines multiple frame types to support HTTP message exchanges and connection management. Each frame has a length and a payload whose length depends on the frame type. quiche was found to be vulnerable when parsing some frame types to pre-allocating memory based on the declared length. An attacker would not need to send the number of declared bytes to trigger this issue. In addition, quiche was found to not apply QPACK decompression limits correctly. This could allow an attacker to send specially crafted HEADERS frames that would cause more memory commitment than otherwise advertised by MAX_FIELD_SECTION_SIZE (configured by set_max_field_section_size()). Mitigation: * Users are requested to upgrade to quiche 0.29.3 which is the earliest version containing the fix for this issue. Credits: Disclosed responsibly by Sébastien Féry