CVE Feed

    Dashboard / CVE / CVE-2024-1765

    CVE-2024-1765

    Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client. A remote attacker could take advantage of this vulnerability by repeatedly sending an unlimited number of 1-RTT CRYPTO frames after previously completing the QUIC handshake. Exploitation was possible for the duration of the connection which could be extended by the attacker.  quiche 0.19.2 and 0.20.1 are the earliest versions containing the fix for this issue.

    Published:Mar 12, 2024
    Last Modified:Aug 6, 2025
    EPS:Mar 12, 2024
    EPSS Score:0.02478
    CVSS Score:5.9

    Affected Products

    Vendor
    Cloudflare
    Product
    Quiche

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-12523 (CVSS 7.5) — Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memo…
    CVE-2026-12707 (CVSS 7.5) — Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded qu…
    CVE-2026-11941 (CVSS 5.6) — Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions…
    CVE-2025-7054 (CVSS 8.7) — Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_C…
    CVE-2025-4821 (CVSS 7.5) — Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could c…
    CVE-2025-4820 (CVSS 5.3) — Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could c…
    CVE-2024-1410 (CVSS 3.7) — Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID…
    CVE-2023-6193 (CVSS 5.3) — quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messag…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High