CVE-2026-12523

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-12523
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12523.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-12523
Aliases
  • GHSA-4fgf-9xrr-88gf
Published
2026-07-14T15:51:28.886Z
Modified
2026-07-21T03:45:59.854986460Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Resource exhaustion in quiche HTTP/3 and QPACK layers
Details

Summary

Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames.

Impact

HTTP/3 defines multiple frame types to support HTTP message exchanges and connection management. Each frame has a length and a payload whose length depends on the frame type. quiche was found to be vulnerable when parsing some frame types to pre-allocating memory based on the declared length. An attacker would not need to send the number of declared bytes to trigger this issue.

In addition, quiche was found to not apply QPACK decompression limits correctly. This could allow an attacker to send specially crafted HEADERS frames that would cause more memory commitment than otherwise advertised by MAXFIELDSECTIONSIZE (configured by setmaxfieldsection_size()).

Mitigation:

  • Users are requested to upgrade to quiche 0.29.3 which is the earliest version containing the fix for this issue.

Credits: Disclosed responsibly by Sébastien Féry

Database specific 
{
    "cna_assigner": "cloudflare",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12523.json"
}
References

Affected packages

Git / github.com/cloudflare/quiche

Affected ranges

Type
GIT
Repo
https://github.com/cloudflare/quiche
Events
Introduced
6d87834466a7e0897f8af0322c5cb162908abcb8
Fixed
55886df3be579579207104c8e645825b6347a209
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "fixed": "0.29.3"
        }
    ]
}

Affected versions

0.*
0.23.3
0.23.4
0.23.5
0.23.6
0.23.7
0.24.0
0.24.1
0.24.2
0.24.3
0.24.4
0.24.5
0.24.6
0.24.7
0.24.8
0.24.9
0.25.0
0.26.0
0.26.1
0.27.0
0.28.0
0.29.0
0.29.1
0.29.2
buffer-pool-0.*
buffer-pool-0.2.0
buffer-pool-0.2.1
datagram-socket-0.*
datagram-socket-0.1.1
datagram-socket-0.2.0
datagram-socket-0.3.0
datagram-socket-0.4.0
datagram-socket-0.5.0
datagram-socket-0.6.0
datagram-socket-0.7.0
datagram-socket-0.8.0
h3i-0.*
h3i-0.4.0
h3i-0.6.0
netlog-0.*
netlog-0.1.0
octets-0.*
octets-0.3.1
octets-0.3.2
octets-0.3.3
octets-0.3.4
octets-0.3.5
octets-0.3.6
qlog-0.*
qlog-0.15.1
qlog-0.15.2
qlog-0.16.0
qlog-0.17.0
qlog-0.18.0
task-killswitch-0.*
task-killswitch-0.1.1
task-killswitch-0.2.0
task-killswitch-0.2.1
tokio-quiche-0.*
tokio-quiche-0.1.0
tokio-quiche-0.10.0
tokio-quiche-0.11.0
tokio-quiche-0.12.0
tokio-quiche-0.13.0
tokio-quiche-0.14.0
tokio-quiche-0.14.1
tokio-quiche-0.14.2
tokio-quiche-0.15.0
tokio-quiche-0.16.0
tokio-quiche-0.18.0
tokio-quiche-0.19.0
tokio-quiche-0.2.0
tokio-quiche-0.2.1
tokio-quiche-0.2.2
tokio-quiche-0.3.0
tokio-quiche-0.3.1
tokio-quiche-0.3.2
tokio-quiche-0.4.0
tokio-quiche-0.4.1
tokio-quiche-0.4.2
tokio-quiche-0.5.0
tokio-quiche-0.6.0
tokio-quiche-0.6.1
tokio-quiche-0.7.0
tokio-quiche-0.7.1
tokio-quiche-0.8.0
tokio-quiche-0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12523.json"