GHSA-xhg9-xwch-vr7x

Impact

Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers (IDs); see RFC 9000 Section 5.1. Endpoints declare the number of active connection IDs they are willing to support using the activeconnectionidlimit transport parameter. The peer can create new IDs using a NEWCONNECTIONID frame but must stay within the active ID limit. This is done by retirement of old IDs, the endpoint sends NEWCONNECTIONID includes a value in the retirepriorto field, which elicits a RETIRECONNECTIONID frame as confirmation. An unauthenticated remote attacker can exploit the vulnerability by sending NEWCONNECTIONID frames and manipulating the connection (e.g. by restricting the peer's congestion window size) so that RETIRECONNECTION_ID frames can only be sent at a slower rate than they are received, leading to storage of information related to connection IDs in an unbounded queue.

Patches

Quiche versions 0.19.2 and 0.20.1 are the earliest to address this problem. There is no workaround for affected versions.