CVE-2025-4820: Cloudflare Quiche DoS Vulnerability

CVE-2025-4820 Overview

Cloudflare quiche, a Rust implementation of the QUIC transport protocol and HTTP/3, contains a congestion control flaw that lets a remote peer inflate the sender's congestion window. An unauthenticated attacker completes a QUIC handshake, requests a congestion-controlled data transfer toward itself, and sends crafted ACK frames using the opportunistic ACK technique described in RFC 9000 Section 21.4. The victim then advances its congestion window beyond what the network path supports and puts more bytes in flight than the path can safely carry. The issue is fixed in quiche 0.24.4 and is tracked under CWE-770, Allocation of Resources Without Limits or Throttling.

Critical Impact
A remote unauthenticated peer can manipulate the victim's congestion controller to transmit data faster than the network path can sustain, causing network congestion and potential packet loss for other flows.

Affected Products

Cloudflare quiche versions prior to 0.24.4
Applications embedding quiche as a QUIC or HTTP/3 library
Rust crates depending on vulnerable quiche versions

Discovery Timeline

2025-06-18 - CVE-2025-4820 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4820

Vulnerability Analysis

QUIC uses ACK frames from the receiver to drive the sender's congestion controller. Each newly acknowledged byte signals available path capacity and expands the congestion window. Quiche did not sufficiently validate that acknowledged packet numbers corresponded to data the receiver could genuinely have observed at that point in time. A malicious peer can therefore acknowledge packets that are still in flight, causing the sender to interpret those acknowledgments as proof of successful delivery.

The result is uncontrolled growth of the congestion window. Quiche keeps sending at increasing rates that the underlying path cannot support. This behavior maps to [CWE-770], where a resource, in this case in-flight bytes and bandwidth, is allocated without adequate throttling. The attack does not require authentication beyond completing a standard QUIC handshake with the victim.

Root Cause

The root cause is insufficient validation of ACK frames against the sender's actual transmission and receipt state. Quiche's congestion controller trusted the peer's acknowledgments without cross-checking whether the acknowledged packets had realistically been received. RFC 9000 Section 21.4 explicitly documents the opportunistic ACK attack and expects implementations to defend against it. Quiche releases prior to 0.24.4 lacked sufficient defenses.

Attack Vector

The attacker initiates a QUIC connection to the victim quiche endpoint and requests a large, congestion-controlled data transfer, for example an HTTP/3 GET for sizable content. As the victim sends packets, the attacker acknowledges packet numbers ahead of what it has actually received. Each unearned ACK inflates the victim's congestion window and increases the sending rate. The attacker can sustain this loop to push the victim into overdriving the network, consuming upstream bandwidth and potentially harming co-located flows. The vulnerability mechanism is described in the Cloudflare quiche security advisory GHSA-2v9p-3p3h-w56j.

Detection Methods for CVE-2025-4820

Indicators of Compromise

Outbound QUIC or HTTP/3 flows from a quiche-based service showing sustained sending rates well above the negotiated path characteristics.
Unusually high ratio of acknowledged packets to observed round-trip time samples on a single QUIC connection.
Client peers issuing ACK frames covering packet numbers unusually close to the latest sent packet with minimal jitter.

Detection Strategies

Inventory Rust services and dependencies to locate quiche versions earlier than 0.24.4 using cargo tree or software composition analysis tooling.
Enable quiche qlog or connection-level telemetry to capture congestion window growth curves and flag rapid, monotonic expansion inconsistent with measured loss and RTT.
Alert when a single remote peer drives outbound bandwidth on one connection above a baseline defined for the service.

Monitoring Recommendations

Track per-connection congestion window, bytes-in-flight, and pacing rate metrics exported from the quiche stack.
Correlate egress bandwidth spikes with QUIC connection identifiers to attribute anomalous throughput to individual peers.
Log and retain qlog traces from production QUIC endpoints so opportunistic ACK patterns can be reconstructed after the fact.

How to Mitigate CVE-2025-4820

Immediate Actions Required

Upgrade all deployments of Cloudflare quiche to version 0.24.4 or later.
Audit every Rust workspace and container image for transitive dependencies on vulnerable quiche crates and rebuild affected binaries.
Restart QUIC-facing services after upgrading to ensure the patched library is loaded.

Patch Information

Cloudflare released the fix in quiche 0.24.4, the earliest version containing the correction to congestion window growth logic. Details are published in the Cloudflare quiche GitHub Security Advisory GHSA-2v9p-3p3h-w56j. Update the quiche entry in Cargo.toml and run cargo update -p quiche to pull the fixed release.

Workarounds

Apply egress bandwidth limits or traffic shaping on QUIC-serving hosts to cap the impact of an inflated congestion window.
Terminate or rate-limit QUIC connections that exceed expected per-flow throughput or exhibit anomalous ACK patterns.
Restrict exposure of quiche-based endpoints to trusted networks where feasible until the upgrade is complete.

bash

# Update quiche in a Rust project to the patched release
cargo update -p quiche --precise 0.24.4
cargo build --release