CVE-2024-1765

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-1765
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-1765.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-1765
Aliases
Related
Published
2024-03-12T18:15:07Z
Modified
2025-09-24T12:20:12.355426Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client. A remote attacker could take advantage of this vulnerability by repeatedly sending an unlimited number of 1-RTT CRYPTO frames after previously completing the QUIC handshake. Exploitation was possible for the duration of the connection which could be extended by the attacker.  quiche 0.19.2 and 0.20.1 are the earliest versions containing the fix for this issue.

References

Affected packages

Git / github.com/cloudflare/quiche

Affected ranges

Type
GIT
Repo
https://github.com/cloudflare/quiche
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c5e4021f65458f69f2ce7f551ae02a6c507073a0

Affected versions

0.*

0.1.0
0.1.0-alpha1
0.1.0-alpha2
0.1.0-alpha3
0.1.0-alpha4
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0
0.15.0
0.16.0
0.17.1
0.17.2
0.18.0
0.19.0
0.19.1
0.2.0
0.3.0
0.4.0
0.5.0
0.5.1
0.6.0
0.7.0
0.8.0
0.8.1
0.9.0

octets-0.*

octets-0.2.0

qlog-0.*

qlog-0.10.0
qlog-0.2.0
qlog-0.3.0
qlog-0.4.0
qlog-0.5.0
qlog-0.6.0
qlog-0.7.0
qlog-0.8.0
qlog-0.9.0