CVE-2026-12707: Cloudflare quiche DoS Vulnerability

CVE-2026-12707 Overview

Cloudflare quiche, a QUIC and HTTP/3 implementation written in Rust, contains a memory resource exhaustion vulnerability tracked as CVE-2026-12707. The flaw resides in the connection migration handling defined in Section 9 of RFC 9000. While quiche implements the anti-amplification protections from Section 9.3, the internal collection of PathEvent entries consumed via path_event_next() is not bounded. A remote peer that completes the QUIC handshake can trigger rapid source address migrations, causing unbounded accumulation of PathEvent::ReusedSourceConnectionId entries. Servers remain vulnerable even when active connection migration is disabled.

Critical Impact
A remote unauthenticated attacker can exhaust server memory after completing a QUIC handshake, leading to denial of service against any application built on vulnerable versions of quiche.

Affected Products

Cloudflare quiche versions prior to 0.29.3
Applications and servers embedding vulnerable quiche releases as their QUIC/HTTP/3 stack
Deployments remain affected even when active connection migration is disabled

Discovery Timeline

2026-07-14 - CVE-2026-12707 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-12707

Vulnerability Analysis

The vulnerability is an unbounded resource allocation flaw categorized under [CWE-770]. quiche exposes path-related notifications to embedding applications through a PathEvent collection, which is drained by calling path_event_next(). The library queues a PathEvent::ReusedSourceConnectionId entry each time a peer reuses a source connection identifier during path validation. The collection has no upper bound and no rate limiting, so applications that do not aggressively drain events accumulate entries indefinitely.

Once the handshake completes, an attacker can force rapid source address changes and generate migration-related events at line rate. Each queued event consumes heap memory in the server process. Sustained migration traffic drives the process toward memory exhaustion, causing degraded performance, out-of-memory termination, or full denial of service.

Root Cause

The root cause is missing capacity enforcement on the internal PathEvent queue. quiche correctly implements the state-commitment protections outlined in RFC 9000 Section 9.3 for peer-initiated migration, but the notification pathway used to inform the host application about reused connection IDs was not subject to those same limits.

Attack Vector

Exploitation requires network reachability to a QUIC endpoint and the ability to complete a QUIC handshake. After the handshake, the attacker repeatedly changes source addresses to trigger PathEvent::ReusedSourceConnectionId generation. No authentication, privileges, or user interaction are required. The impact is limited to availability. Confidentiality and integrity are not affected.

No verified exploit code is publicly available. See the GitHub Security Advisory for the upstream technical description.

Detection Methods for CVE-2026-12707

Indicators of Compromise

Sustained growth in resident memory of processes linking quiche without a corresponding increase in active connections
High volume of QUIC packets from a single peer arriving from many distinct source IP address or port tuples in a short interval
Application logs or metrics showing rapid growth of the PathEvent queue length if instrumented
Out-of-memory terminations of QUIC-serving processes shortly after handshake completion spikes

Detection Strategies

Inventory all services that embed quiche and confirm the linked version against 0.29.3 or later
Monitor QUIC endpoints for connections that generate abnormal rates of path validation activity after handshake
Correlate network telemetry showing frequent source address changes per QUIC connection ID with server memory pressure

Monitoring Recommendations

Track process-level memory usage on QUIC and HTTP/3 servers and alert on sustained upward trends
Ingest QUIC connection metrics into a centralized logging or SIEM platform for cross-source correlation
Instrument applications to expose the depth of the PathEvent queue as a metric where feasible

How to Mitigate CVE-2026-12707

Immediate Actions Required

Upgrade quiche to version 0.29.3 or later, which enforces bounds on PathEvent::ReusedSourceConnectionId queuing
Rebuild and redeploy any application or service statically linking or vendoring quiche
Identify affected hosts and prioritize internet-exposed QUIC and HTTP/3 endpoints

Patch Information

Cloudflare released quiche0.29.3 as the earliest version that prevents excessive queuing of PathEvent::ReusedSourceConnectionId events. Refer to the Cloudflare quiche GitHub Security Advisory for release notes and patch details.

Workarounds

Ensure the embedding application calls path_event_next() in a tight loop to fully drain the PathEvent collection on every connection processing cycle
Apply per-peer rate limits or connection quotas at the network edge to reduce sustained migration-event pressure
Disable QUIC or HTTP/3 listeners on non-essential services until the patched version is deployed

bash

# Configuration example: pin quiche to a patched version in Cargo.toml
[dependencies]
quiche = ">=0.29.3"