Incorrect Congestion Window Growth in Cloudflare Quiche

CVE-2025-4821

What is CVE-2025-4821?

Cloudflare Quiche has a vulnerability involving incorrect growth of the congestion window, allowing for data transmission at potentially unsuitable rates. An unauthenticated attacker could exploit this flaw by completing a handshake and sending manipulated ACK frames. These frames may cover a wide range of packet numbers, allowing the attacker to interfere with the victim's congestion control state. Consequently, this may lead to excessive growth of the congestion window, exceeding the path's capabilities, and in extreme scenarios, result in an overflow panic due to reaching the internal variable's limit. It's imperative for users to update to Quiche version 0.24.4 or later, which addresses this issue.

References