Resource Exhaustion Vulnerability in Cloudflare Quiche HTTP/3 Implementation

CVE-2026-12523

What is CVE-2026-12523?

The Cloudflare Quiche HTTP/3 library is susceptible to a resource exhaustion issue due to its handling of specially crafted HTTP/3 frames. When parsing certain frame types, the library does not allocate memory correctly based on the specified lengths, allowing attackers to trigger excessive memory usage without matching the declared byte count. Additionally, improper QPACK decompression limit enforcement may let attackers exploit HEADERS frames, leading to far more memory commitment than intended. Users are advised to upgrade to version 0.29.3 or later to mitigate this vulnerability.

References