CVE-2025-4821 Overview
CVE-2025-4821 affects Cloudflare quiche, an implementation of the QUIC transport protocol and HTTP/3 written in Rust. The vulnerability stems from incorrect congestion window growth in the library's congestion control logic. An unauthenticated remote attacker can manipulate a victim's congestion control state by sending crafted ACK frames covering packet numbers that were never sent. This causes the congestion window to grow beyond expected limits. In extreme cases, the internal variable overflows, triggering a panic and resulting in denial of service. Cloudflare addressed the issue in quiche version 0.24.4.
Critical Impact
Remote attackers can trigger an integer overflow panic in quiche, causing denial of service against systems using affected versions of the QUIC library.
Affected Products
- Cloudflare quiche versions prior to 0.24.4
- Applications and services built on the cloudflare:quiche Rust crate
- Any deployment using quiche for QUIC or HTTP/3 transport
Discovery Timeline
- 2025-06-18 - CVE-2025-4821 published to NVD
- 2025-11-06 - Last updated in NVD database
Technical Details for CVE-2025-4821
Vulnerability Analysis
The vulnerability resides in the congestion control state machine of quiche. QUIC uses ACK frames to inform senders which packets have been received, and the sender uses this information to update its congestion window. RFC 9000 Section 19.3 defines the structure of ACK frames, including ACK ranges that identify received packet numbers.
The issue is classified under [CWE-770] (Allocation of Resources Without Limits or Throttling). The flaw allows an attacker to acknowledge packet numbers that were never transmitted by the victim. The congestion controller treats these as legitimate acknowledgments and increases the window accordingly. The resulting growth can exceed the bounds of the internal counter, producing an arithmetic overflow that triggers a Rust panic and terminates the connection or process.
Root Cause
The congestion control code does not validate that acknowledged packet numbers correspond to packets the local endpoint actually sent. Without this bounds check, the implementation accepts attacker-supplied ACK ranges and applies congestion window growth based on phantom acknowledgments. The internal variable type does not enforce a saturating ceiling, allowing the value to overflow.
Attack Vector
Exploitation requires the attacker to complete a standard QUIC handshake with the target. The attacker then initiates a congestion-controlled data transfer from the victim. During the transfer, the attacker sends ACK frames that include large ranges covering packet numbers beyond what the victim has transmitted. The victim's congestion controller processes these frames, inflates the congestion window, and eventually panics when the variable overflows. No authentication or user interaction is required beyond the initial connection setup.
The vulnerability is described in detail in the Cloudflare quiche Security Advisory GHSA-6m38-4r9r-5c4m.
Detection Methods for CVE-2025-4821
Indicators of Compromise
- Unexpected process termination or panic messages from applications linking quiche versions prior to 0.24.4
- QUIC connections exhibiting congestion window growth inconsistent with sent traffic volume
- ACK frames received with packet number ranges exceeding the highest packet number transmitted by the local endpoint
Detection Strategies
- Inventory all services and applications that embed the cloudflare:quiche Rust crate and identify those running versions below 0.24.4
- Monitor application logs for Rust panic traces referencing congestion control or arithmetic overflow conditions
- Inspect QUIC telemetry for anomalies between bytes-in-flight metrics and observed network throughput
Monitoring Recommendations
- Enable verbose logging in quiche-based services to capture connection-level congestion control state transitions
- Collect crash dumps and panic backtraces from production hosts and forward them to a centralized logging platform
- Track QUIC connection failure rates and correlate spikes with peer IP addresses to identify abusive clients
How to Mitigate CVE-2025-4821
Immediate Actions Required
- Upgrade quiche to version 0.24.4 or later across all affected services
- Rebuild and redeploy applications that statically link the quiche crate after updating the dependency
- Audit transitive dependencies in Rust projects using cargo tree to identify indirect usage of vulnerable quiche versions
Patch Information
Cloudflare released the fix in quiche version 0.24.4. The patch adds validation that prevents the congestion controller from accepting ACK frames for packet numbers that were never sent. Refer to the Cloudflare quiche Security Advisory GHSA-6m38-4r9r-5c4m for the official patch notes and version details.
Workarounds
- Restrict QUIC connectivity to trusted peers using firewall rules where operationally feasible
- Disable QUIC and HTTP/3 endpoints if patching cannot be performed immediately, falling back to TCP-based HTTP/2
- Apply rate limiting and connection quotas on QUIC listeners to reduce the attack surface from unauthenticated clients
# Update quiche in Cargo.toml and rebuild
cargo update -p quiche --precise 0.24.4
cargo build --release
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
