Use-After-Free Vulnerabilities in Cloudflare Quiche

CVE-2026-11941

What is CVE-2026-11941?

Cloudflare Quiche has been found to have two use-after-free vulnerabilities within its FFI functions: 'quiche_connection_id_iter_next' and 'quiche_conn_retired_scid_next'. These functions return a pointer to a 'ConnectionId' to applications, but the management of the memory is flawed, leading to freed memory dereferencing when the function scope ends. Applications utilizing these functions may experience undefined behavior, potentially causing crashes or denial of service. In some instances, it could also result in information disclosure through neighboring heap contents. To mitigate this issue, users are strongly advised to upgrade to Quiche version 0.29.2, which includes the necessary fix.

References