CVE-2026-12523: Cloudflare quiche HTTP/3 DoS Vulnerability

CVE-2026-12523 Overview

Cloudflare quiche contains a resource exhaustion vulnerability in its HTTP/3 layer. Specially crafted HTTP/3 frames trigger excessive memory allocation on the server. The library pre-allocates memory based on the declared frame length without requiring the attacker to send the corresponding number of bytes. A separate flaw allows attackers to bypass QPACK decompression limits configured through set_max_field_section_size(). Remote unauthenticated attackers can send malicious HEADERS frames to force memory commitment beyond the advertised MAX_FIELD_SECTION_SIZE. This vulnerability is tracked under [CWE-400] (Uncontrolled Resource Consumption). Cloudflare addressed the issue in quiche version 0.29.3.

Critical Impact
Unauthenticated remote attackers can exhaust server memory over a single HTTP/3 connection, causing denial of service against applications built on Cloudflare quiche.

Affected Products

Cloudflare quiche versions prior to 0.29.3
Applications embedding quiche as their HTTP/3 implementation
Servers exposing QUIC/HTTP/3 endpoints backed by quiche

Discovery Timeline

Vulnerability responsibly disclosed by Sébastien Féry
2026-07-14 - CVE-2026-12523 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-12523

Vulnerability Analysis

HTTP/3 defines multiple frame types that carry a length field followed by a payload sized according to that length. When quiche parses several of these frame types, it pre-allocates a buffer sized to the declared length before receiving the payload. An attacker declares a large length in the frame header but does not need to transmit the corresponding bytes. The library still commits the memory, allowing a single attacker to amplify a small number of bytes on the wire into large server-side allocations.

A second defect involves QPACK, the HTTP/3 header compression scheme. quiche fails to enforce the MAX_FIELD_SECTION_SIZE limit configured through set_max_field_section_size() during decompression. Crafted HEADERS frames force memory commitment that exceeds the advertised bound. Together, the two issues let a remote attacker consume disproportionate memory without authentication or user interaction.

Root Cause

The root cause is missing validation between declared frame metadata and actual resource commitment. quiche trusted the length field in HTTP/3 frames as an allocation hint. The QPACK decoder path did not check accumulated decompressed field section size against the configured maximum. Both paths violate the resource management expectations described in [CWE-400].

Attack Vector

Exploitation requires only network reachability to a QUIC/HTTP/3 endpoint running vulnerable quiche. The attacker opens an HTTP/3 connection and sends frames with inflated length fields or crafted HEADERS frames that expand beyond QPACK limits during decompression. Repeated frames on one or many connections drive the target process toward memory exhaustion and denial of service. Confidentiality and integrity are not affected; the impact is availability.

No public proof-of-concept code is available. Technical detail is documented in the GitHub Security Advisory.

Detection Methods for CVE-2026-12523

Indicators of Compromise

Sustained memory growth in processes linking quiche, particularly during active HTTP/3 traffic
HTTP/3 frames whose declared length is large relative to bytes actually delivered on the QUIC stream
HEADERS frames producing decompressed field sections larger than the value set via set_max_field_section_size()
Repeated QUIC connections from a single source that terminate after triggering high allocation

Detection Strategies

Instrument quiche-based services to log per-connection peak memory and frame length statistics
Correlate spikes in resident set size with active HTTP/3 stream counts and remote peer IPs
Alert on decompressed header sizes that approach or exceed configured QPACK limits
Track version strings of deployed quiche libraries across the fleet to identify unpatched instances

Monitoring Recommendations

Enable QUIC and HTTP/3 telemetry at the edge, including frame type distributions and length histograms
Monitor kernel OOM killer events on hosts running HTTP/3 termination
Rate limit new QUIC connections and streams per source to bound worst-case memory
Feed HTTP/3 access and error logs into a centralized data lake for longitudinal analysis

How to Mitigate CVE-2026-12523

Immediate Actions Required

Upgrade all deployments of Cloudflare quiche to version 0.29.3 or later
Inventory downstream projects and container images that vendor quiche and rebuild them against the patched release
Restart HTTP/3 services after upgrade to ensure the fixed library is loaded
Review capacity headroom on QUIC-terminating hosts until patching completes

Patch Information

Cloudflare released quiche 0.29.3 as the earliest version containing the fix. The patch corrects pre-allocation logic in HTTP/3 frame parsing and enforces MAX_FIELD_SECTION_SIZE during QPACK decompression. Refer to the GitHub Security Advisory GHSA-4fgf-9xrr-88gf for full remediation guidance.

Workarounds

Restrict inbound HTTP/3 traffic at network boundaries where feasible until quiche is upgraded
Apply strict per-source connection and stream rate limits at the load balancer
Configure conservative process memory limits with systemd or container runtimes to contain damage from exhaustion
Temporarily disable HTTP/3 and fall back to HTTP/2 over TLS for exposed services that cannot be patched immediately

bash

# Configuration example
# Update quiche dependency to the patched release in Cargo.toml
# [dependencies]
# quiche = "0.29.3"
cargo update -p quiche --precise 0.29.3
cargo build --release