What is the CVSS score of CVE-2026-11941?

CVE-2026-11941 has a CVSS 3.1 base score of 5.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-11941?

Yes, a public proof-of-concept exploit is available for CVE-2026-11941. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-11941?

Yes, a patch is available for CVE-2026-11941. Update the affected software to the latest version immediately.

Cloudflare Quiche CVE-2026-11941

EUVD-2026-38003 MEDIUM

Use After Free (CWE-416)

2026-06-19 cloudflare

GHSA-mh64-ph39-mrc9

Use After Free Memory Corruption Information Disclosure Denial Of Service Quiche

5.6

CVSS 3.1 · Vendor: cloudflare

Severity by source

Vendor (cloudflare) PRIMARY

5.6 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

5.6 MEDIUM

AV:N because remote QUIC traffic triggers the vulnerable path; AC:H because the non-default FFI build flag is a concrete prerequisite; PR:N and UI:N since no authentication or user action is required.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (cloudflare).

CVSS VectorVendor: cloudflare

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 11:51 vuln.today

DescriptionCVE.org

Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions.

The “quiche_connection_id_iter_next” and “quiche_conn_retired_scid_next” functions would return a pointer to a “ConnectionId” to the applications via function arguments, but the owned “ConnectionId” would be dropped at the end of those functions' scope.

Only applications using those FFI functions are affected. The FFI API is disabled by default by a build-time feature flag.

Impact If unpatched, an application calling the affected FFI functions will dereference freed memory. The most likely outcome is undefined behavior leading to a process crash (denial of service). Depending on allocator state, the read may also return adjacent heap contents, resulting in limited information disclosure or incorrect connection identifier handling.

Mitigation Users are requested to upgrade to quiche 0.29.2 which is the earliest version containing the fix for this issue.

AnalysisAI

Use-after-free memory corruption in Cloudflare Quiche's FFI layer exposes applications built with the non-default FFI feature flag to remote denial of service and limited heap disclosure. Two FFI iterator functions - quiche_connection_id_iter_next and quiche_conn_retired_scid_next - return raw pointers to ConnectionId values that are immediately freed when their owning Rust scope exits, leaving callers holding dangling pointers. No public exploit has been identified at time of analysis and there is no CISA KEV listing, but the CVSS 5.6 (AV:N/AC:H) score correctly reflects the constrained preconditions imposed by the opt-in build flag.

Technical ContextAI

Cloudflare Quiche is a Rust implementation of the QUIC transport protocol and HTTP/3 (CPE: cpe:2.3:a:cloudflare:quiche:*). The affected code lives in its C-compatible Foreign Function Interface (FFI) layer, which is compiled only when a build-time feature flag is explicitly enabled at compile time - it is OFF by default. The two functions, quiche_connection_id_iter_next and quiche_conn_retired_scid_next, iterate over active and retired QUIC Source Connection Identifiers (SCIDs). Both functions are supposed to return a pointer to a ConnectionId value via an output argument for the caller to consume. Due to a Rust ownership defect, the owned ConnectionId is dropped (freed by Rust's allocator) at the end of the function's local scope, while the raw pointer to that now-freed memory is simultaneously handed to the caller. Any subsequent dereference by the caller is a textbook use-after-free (CWE-416), a class of memory safety errors that produce non-deterministic behavior ranging from crashes to heap disclosure, depending on allocator state between the free and the read.

RemediationAI

Vendor-released patch: quiche 0.29.2, confirmed by Cloudflare as the earliest version containing the fix. Update the quiche dependency in your Cargo.toml to version 0.29.2 or later and rebuild all affected applications. If an immediate upgrade is not possible, the most effective compensating control is to rebuild Quiche without the FFI feature flag, which entirely eliminates the vulnerable code paths; this may require refactoring any application logic that depends on the C-compatible FFI API, and that refactoring effort should be weighed against the patching timeline. If both the FFI feature and an immediate upgrade are unavoidable constraints, restrict network-level access to the affected QUIC service using firewall rules or mutual TLS to limit the pool of peers who can trigger connection ID iteration, accepting reduced network accessibility as the trade-off. Full advisory: https://github.com/cloudflare/quiche/security/advisories/GHSA-mh64-ph39-mrc9.