CVE-2026-12523: Resource exhaustion in quiche HTTP/3 and QPACK layers
Summary
Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames.
Impact
HTTP/3 defines multiple frame types to support HTTP message exchanges and connection management. Each frame has a length and a payload whose length depends on the frame type. quiche was found to be vulnerable when parsing some frame types to pre-allocating memory based on the declared length. An attacker would not need to send the number of declared bytes to trigger this issue.
In addition, quiche was found to not apply QPACK decompression limits correctly. This could allow an attacker to send specially crafted HEADERS frames that would cause more memory commitment than otherwise advertised by MAXFIELDSECTIONSIZE (configured by setmaxfieldsectionsize()).
Mitigation:
Users are requested to upgrade to quiche 0.29.3 which is the earliest version containing the fix for this issue.
Credits: Disclosed responsibly by Sébastien Féry
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cloudflare quicheto a version that resolves this vulnerability.Fixed in 0.29.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12523?
CVE-2026-12523 has a high severity rating of 7.5.
What type of vulnerability is CVE-2026-12523?
CVE-2026-12523 is a resource exhaustion vulnerability affecting the HTTP/3 layer of Cloudflare quiche.
How does CVE-2026-12523 affect my system?
CVE-2026-12523 can lead to memory exhaustion through specially crafted HTTP/3 frames.
How do I fix CVE-2026-12523?
To fix CVE-2026-12523, update to the latest version of Cloudflare quiche that addresses this vulnerability.
Who is affected by CVE-2026-12523?
Any users or systems utilizing Cloudflare quiche with HTTP/3 capabilities may be affected by CVE-2026-12523.