CVE-2024-1765

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-1765
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-1765.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-1765
Aliases
Published
2024-03-12T18:04:54.915Z
Modified
2026-07-15T02:11:05.842893936Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche
Details

Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client. A remote attacker could take advantage of this vulnerability by repeatedly sending an unlimited number of 1-RTT CRYPTO frames after previously completing the QUIC handshake. Exploitation was possible for the duration of the connection which could be extended by the attacker.  quiche 0.19.2 and 0.20.1 are the earliest versions containing the fix for this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1765.json",
    "cna_assigner": "cloudflare"
}
References

Affected packages

Git / github.com/cloudflare/quiche

Affected ranges

Type
GIT
Repo
https://github.com/cloudflare/quiche
Events
Introduced
fde3185409b1ea989c73c2dd9645965684667fee
Last affected
3398ceabaf5f64f0d8535ae6e0a827ede8835a08
Introduced
5b1e3d286411e2cc411f8dc6d6ff1ee40f1bd026
Fixed
dae27b7d5a0dcf8304a56ffd295399fc00ec03e9
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.15.0"
        },
        {
            "last_affected": "<0.19.1"
        },
        {
            "introduced": "0.20.0"
        },
        {
            "fixed": "<0.20.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.20.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-1765.json"