PT-2025-32266 · Cloudflare · Cloudflare Quiche

Catenacyber · Published 2025-08-07 · Updated 2025-08-14 · CVE-2025-7054

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Cloudflare quiche versions 0.15.0 through 0.24.5

Description Cloudflare quiche is susceptible to an infinite loop when processing packets containing RETIRE CONNECTION ID frames. QUIC connections utilize connection identifiers (IDs) with sequence numbers to maintain synchronization between peers. An unauthenticated remote attacker can trigger this issue by sending specially crafted frames after completing a handshake, causing the victim to enter an infinite loop when attempting to send packets with RETIRE CONNECTION ID frames. This occurs due to a design feature supporting retirement across paths while maintaining connection ID synchronization.

Recommendations Cloudflare quiche versions prior to 0.24.5 are affected. Upgrade to version 0.24.5 or later to resolve this issue.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2025-10362

CVE-2025-7054

GHSA-M3HH-F9GH-74C2

Affected Products

Cloudflare Quiche

References · 10

• https://bdu.fstec.ru/vul/2025-10362 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7054 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m3hh-f9gh-74c2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7054 · Security Note
• https://github.com/cloudflare/quiche/security/advisories/GHSA-m3hh-f9gh-74c2 · Note
• https://github.com/cloudflare/quiche · Note
• https://twitter.com/InteleModel/status/1953826545820422509 · Twitter Post
• https://twitter.com/CVEnew/status/1953482927364313525 · Twitter Post
• https://t.me/cveNotify/132353 · Telegram Post
• https://twitter.com/CveFindCom/status/1953481303753400564 · Twitter Post