CVE-2023-6193

    Dashboard / Vulnerabilities / CVE-2023-6193

    CVE-2023-6193

    Published: 12 Dec 2023Last Modified: 28 Oct 2026

    Summary: Unbounded queuing of path validation messages in cloudflare-quiche

    Details: quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path validation (RFC 9000 Section 8.2) requires that the recipient of a PATH_CHALLENGE frame responds by sending a PATH_RESPONSE. An unauthenticated remote attacker can exploit the vulnerability by sending PATH_CHALLENGE frames and manipulating the connection (e.g. by restricting the peer's congestion window size) so that PATH_RESPONSE frames can only be sent at the slower rate than they are received; leading to storage of path validation data in an unbounded queue. Quiche versions greater than 0.19.0 address this problem.

    References: https://datatracker.ietf.org/doc/html/rfc9000#section-8.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6193.json, https://github.com/cloudflare/quiche/security/advisories/GHSA-w3vp-jw9m-f9pm, https://nvd.nist.gov/vuln/detail/CVE-2023-6193

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- fde3185409b1ea989c73c2dd9645965684667fee
    Fixed -None

    Affected versions

    tokio-quiche-0.19.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-6193 | CVE-DB