GHSA-mh64-ph39-mrc9

Suggest an improvement
Source
https://github.com/advisories/GHSA-mh64-ph39-mrc9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mh64-ph39-mrc9/GHSA-mh64-ph39-mrc9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mh64-ph39-mrc9
Aliases
Published
2026-06-19T22:10:29Z
Modified
2026-06-19T22:26:27Z
Severity
  • 5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Cloudflare Quiche: Use-after-free in connection ID iterator FFI functions
Details

Impact

Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions.

The quiche_connection_id_iter_next and quiche_conn_retired_scid_next functions would return a pointer to a ConnectionId to the applications via function arguments, but the the owned ConnectionId would be dropped at the end of those functions' scope.

Only applications using those FFI functions are affected. The FFI API is disabled by default by a build-time feature flag.

quiche 0.29.2 is the earliest version containing the fix for this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-416"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T22:10:29Z",
    "nvd_published_at": "2026-06-19T12:16:26Z",
    "severity": "MODERATE"
}
References

Affected packages

crates.io / quiche

Package

Name
quiche
View open source insights on deps.dev
Purl
pkg:cargo/quiche

Affected ranges

Type
SEMVER
Events
Introduced
0.20.0
Fixed
0.29.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mh64-ph39-mrc9/GHSA-mh64-ph39-mrc9.json"