PT-2024-2630 · Cloudflare · Cloudflare Quiche

Marten Seeman + 1 · Published 2024-03-12 · Updated 2025-08-06 · CVE-2024-1765

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cloudflare Quiche versions 0.19.1 through 0.20.0

Description The issue is related to an unlimited resource allocation vulnerability, causing a rapid increase in memory usage of the system running the quiche server or client. A remote attacker could exploit this by repeatedly sending an unlimited number of 1-RTT CRYPTO frames after completing the QUIC handshake. Exploitation was possible for the duration of the connection, which could be extended by the attacker.

Recommendations For versions prior to 0.19.2 and 0.20.1, update to version 0.19.2 or 0.20.1 to resolve the issue. As a temporary workaround, consider restricting the number of 1-RTT CRYPTO frames that can be sent after the QUIC handshake to minimize the risk of exploitation.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BDU:2024-02697

CVE-2024-1765

GHSA-78WX-JG4J-5J6G

Affected Products

Cloudflare Quiche

References · 14

• https://github.com/cloudflare/quiche/security/advisories/GHSA-78wx-jg4j-5j6g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-1765 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1765 · Security Note
• https://bdu.fstec.ru/vul/2024-02697 · Security Note
• https://osv.dev/vulnerability/GHSA-78wx-jg4j-5j6g · Vendor Advisory
• https://github.com/cloudflare/quiche · Note
• https://github.com/cloudflare/quiche/releases/tag/0.19.2 · Note
• https://github.com/cloudflare/quiche/commit/1017466c143fc93a82b286a1ba35e53334cdf8e2 · Note
• https://github.com/cloudflare/quiche/releases/tag/0.20.1 · Note
• https://github.com/cloudflare/quiche/commit/11dbf5461ab657bbc02e466d719070124b27ef3c · Note
• https://t.me/cvenotify/73638 · Telegram Post
• https://t.me/cveNotify/131083 · Telegram Post
• https://twitter.com/CVEnew/status/1767616199863529613 · Twitter Post
• https://t.me/cvenotify/73703 · Telegram Post