What is the CVSS score of CVE-2025-4821?

CVE-2025-4821 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Quiche are affected by CVE-2025-4821?

Cloudflare quiche QUIC protocol implementation versions prior to 0.24.4 contain a congestion control flaw that allows unauthenticated remote attackers to trigger denial of service by manipulating ACK…. A patch is available.

How to fix or mitigate CVE-2025-4821?

Within 24 hours: Identify all services and dependencies using Cloudflare quiche and document current versions. Within 7 days: Upgrade quiche to version 0.24.4 or later across all affected systems and applications. Within 30 days: Validate upgrades in production environments and confirm no regressions in QUIC connectivity or performance metrics.

Quiche CVE-2025-4821

EUVD-2025-18651 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2025-06-18 cna@cloudflare.com

Buffer Overflow Quiche Cloudflare

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:37 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

0.24.4

EUVD ID Assigned

Mar 14, 2026 - 22:49 euvd

EUVD-2025-18651

Analysis Generated

Mar 14, 2026 - 22:49 vuln.today

CVE Published

Jun 18, 2025 - 16:15 nvd

HIGH 7.5

DescriptionCVE.org

Impact

Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.

An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames covering a large range of packet numbers (including packet numbers that had never been sent); see RFC 9000 Section 19.3. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support. In extreme cases, the window might grow beyond the limit of the internal variable's type, leading to an overflow panic.

Patches

quiche 0.24.4 is the earliest version containing the fix for this issue.

AnalysisAI

Cloudflare quiche, a QUIC protocol implementation, contains a congestion control vulnerability (CVE-2025-4821) where an unauthenticated remote attacker can manipulate ACK frames to artificially inflate the congestion window beyond safe limits, causing excessive data transmission rates and potential denial of service through integer overflow panics. The vulnerability affects quiche versions prior to 0.24.4. While the CVSS score is 7.5 (high severity with network attack vector and no privileges required), real-world exploitation requires completing a QUIC handshake and active manipulation, limiting opportunistic exploitation.

Technical ContextAI

Cloudflare quiche is a QUIC protocol implementation (RFC 9000 compliant). The vulnerability stems from improper congestion window (cwnd) growth logic in the congestion control state machine. Specifically, the implementation fails to properly validate ACK frame packet number ranges before applying congestion window increases. RFC 9000 Section 19.3 defines ACK semantics—legitimate ACKs should only reference previously sent packets. The vulnerability exploits this by sending ACK frames covering packet numbers that were never transmitted, causing the victim's congestion control algorithm to grow the cwnd excessively. This is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), where the congestion window resource is allocated without proper bounds checking. The root cause is missing validation of packet number ranges in ACK processing before applying congestion control window growth calculations. Affected CPE: cpe:2.3:a:cloudflare:quiche:*:*:*:*:*:*:*:* (versions < 0.24.4).

RemediationAI

Primary Patch: Upgrade Cloudflare quiche to version 0.24.4 or later; verification: Confirm version via quiche --version or cargo tree (if building from source); references: Cloudflare Security Advisory (expected at https://github.com/cloudflare/quiche or security page) Interim Mitigation: If immediate patching is not possible: (1) Rate-limit QUIC connections per source IP; (2) Monitor for abnormal ACK packet patterns (ACKs referencing unsent packet numbers); (3) Implement stricter packet number validation in ACK processing; (4) Deploy connection-level resource limits (max cwnd cap regardless of ACK claims); effectiveness: Partial—slows exploitation but does not eliminate vulnerability Detection: Monitor application logs for panic/crash errors in quiche congestion control; correlate with QUIC connection termination patterns; alert on ACK frames with anomalously high packet number ranges; effectiveness: Reactive—detects active exploitation attempts