CVE-2026-11941: Cloudflare Quiche Use-After-Free Flaw

CVE-2026-11941 Overview

CVE-2026-11941 describes two use-after-free vulnerabilities in Cloudflare Quiche, an implementation of the QUIC transport protocol and HTTP/3. The flaws reside in the Foreign Function Interface (FFI) layer, specifically in the quiche_connection_id_iter_next and quiche_conn_retired_scid_next functions. Both functions return a pointer to a ConnectionId through output arguments, but the owned ConnectionId is dropped when the function scope ends. Applications dereferencing those pointers operate on freed heap memory. Only applications using the FFI API are affected, and that API is disabled by default via a build-time feature flag. The issue is tracked under CWE-416: Use After Free.

Critical Impact
Applications calling the affected FFI functions dereference freed memory, leading to process crashes (denial of service), potential information disclosure from adjacent heap contents, or incorrect connection identifier handling.

Affected Products

Cloudflare Quiche versions prior to 0.29.2
Applications linking the Quiche FFI API with the build-time feature flag enabled
Downstream projects embedding vulnerable Quiche releases for QUIC/HTTP/3 support

Discovery Timeline

2026-06-19 - CVE-2026-11941 published to the National Vulnerability Database
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-11941

Vulnerability Analysis

The defect occurs at the Rust-to-C boundary exposed by Quiche's FFI layer. Both quiche_connection_id_iter_next and quiche_conn_retired_scid_next construct a ConnectionId value on the stack, then write a pointer to that value back to the caller through an output parameter. Rust's ownership model drops the owned ConnectionId once the function returns, freeing the underlying heap allocation. The caller is left holding a dangling pointer to memory the allocator may immediately reuse.

Any subsequent read through the returned pointer accesses freed memory. The outcome depends on allocator behavior at the time of access. Common results include process termination through memory corruption checks, returning stale or attacker-influenceable bytes from an adjacent allocation, or producing an incorrect connection identifier that disrupts QUIC session handling.

Root Cause

The root cause is a lifetime mismatch between an owned Rust value and a raw pointer crossing the FFI boundary. The functions return ownership semantics that the C API cannot enforce. Returning a borrowed pointer to a temporary that is dropped at scope end violates the invariant that FFI-exposed pointers must remain valid for the caller's use.

Attack Vector

Exploitation requires the target application to be built with the FFI feature flag enabled and to invoke one of the two affected functions during normal QUIC connection handling. A remote peer that drives connection ID rotation or migration can trigger the vulnerable code paths. The high attack complexity reflects dependence on allocator state and heap layout at the moment of the dangling read.

No verified public exploit code is available. See the Cloudflare Quiche security advisory GHSA-mh64-ph39-mrc9 for technical details from the maintainers.

Detection Methods for CVE-2026-11941

Indicators of Compromise

Unexpected crashes or SIGSEGV terminations in processes that link Quiche with the FFI feature flag enabled
Address Sanitizer or Valgrind reports flagging heap-use-after-free in quiche_connection_id_iter_next or quiche_conn_retired_scid_next
Anomalous QUIC connection identifier values appearing in application logs during connection migration or retirement events

Detection Strategies

Inventory binaries and libraries that statically or dynamically link Quiche, and verify the linked version is 0.29.2 or later
Run fuzzing or instrumented test suites against QUIC code paths exercising connection ID iteration and SCID retirement
Review application source code for calls to the two affected FFI functions and validate pointer lifetime handling

Monitoring Recommendations

Track crash telemetry on QUIC/HTTP/3 endpoints for repeated faults correlated with connection migration events
Alert on abnormal volumes of QUIC connections that trigger connection ID rotation, which may indicate probing for the vulnerable paths
Centralize core dumps and stack traces from network-facing services to identify recurring faults in the Quiche FFI layer

How to Mitigate CVE-2026-11941

Immediate Actions Required

Upgrade Quiche to version 0.29.2 or later, which contains the fix for both use-after-free conditions
Audit application code for invocations of quiche_connection_id_iter_next and quiche_conn_retired_scid_next and validate object lifetimes
Rebuild and redeploy downstream artifacts that statically link an affected Quiche version

Patch Information

Cloudflare released the fix in Quiche 0.29.2. The advisory at GHSA-mh64-ph39-mrc9 documents the affected functions and the corrected lifetime handling. Operators should pull the patched release from the project repository and rebuild any consumers.

Workarounds

Disable the FFI build-time feature flag if the C API is not required, which removes the affected entry points entirely
Restrict use of the affected functions in application code until the patched Quiche version can be deployed
Apply compiler hardening and heap allocator protections such as MALLOC_PERTURB_ or scudo to reduce reliability of any read of freed memory

bash

# Update Quiche to the patched release in a Rust project
cargo update -p quiche --precise 0.29.2

# Verify the resolved version
cargo tree -p quiche