What is the CVSS score of CVE-2026-12523?

CVE-2026-12523 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Cloudflare quiche are affected by CVE-2026-12523?

Cloudflare quiche's HTTP/3 implementation contains memory exhaustion vulnerabilities that allow unauthenticated remote attackers to trigger denial of service against QUIC servers.. A patch is available.

How to fix or mitigate CVE-2026-12523?

Within 24 hours: Conduct asset inventory to identify all systems and services using Cloudflare quiche and document current deployed versions; enable detailed QUIC traffic logging and set baseline resource monitoring alerts on affected servers. Within 7 days: Deploy connection-rate limiting (per-source IP) and enforce strict per-connection memory resource caps; implement network-level QUIC traffic filtering to drop malformed frames; configure circuit breakers and graceful degradation in applications dependent on HTTP/3. Within 30 days: Monitor Cloudflare security advisories daily for vendor-released patches; test patched quiche versions in staging environment; if no patch is released within 60 days, evaluate alternative QUIC implementations or disable HTTP/3 entirely pending remediation.

Cloudflare quiche CVE-2026-12523

EUVD-2026-43748 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-14 cloudflare

Denial Of Service Quiche

7.5

CVSS 3.1 · Vendor: cloudflare

Severity by source

Vendor (cloudflare) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable HTTP/3 endpoint, no authentication or interaction, low complexity; memory exhaustion yields availability-only impact, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cloudflare).

CVSS VectorVendor: cloudflare

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 14, 2026 - 18:20 EUVD

Analysis Generated

Jul 14, 2026 - 16:32 vuln.today

CVE Published

Jul 14, 2026 - 15:51 cve.org

HIGH 7.5

DescriptionCVE.org

Summary

Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames.

Impact

HTTP/3 defines multiple frame types to support HTTP message exchanges and connection management. Each frame has a length and a payload whose length depends on the frame type. quiche was found to be vulnerable when parsing some frame types to pre-allocating memory based on the declared length. An attacker would not need to send the number of declared bytes to trigger this issue.

In addition, quiche was found to not apply QPACK decompression limits correctly. This could allow an attacker to send specially crafted HEADERS frames that would cause more memory commitment than otherwise advertised by MAX_FIELD_SECTION_SIZE (configured by set_max_field_section_size()).

Mitigation:

Users are requested to upgrade to quiche 0.29.3 which is the earliest version containing the fix for this issue.

Credits: Disclosed responsibly by Sébastien Féry

AnalysisAI

Remote memory exhaustion in Cloudflare quiche's HTTP/3 layer allows unauthenticated attackers to crash or degrade QUIC servers by sending specially crafted HTTP/3 frames that trigger over-allocation. Two distinct defects are involved: frame parsers pre-allocate buffers based on an attacker-declared length field without requiring the bytes to actually be sent, and QPACK decompression fails to enforce the configured MAX_FIELD_SECTION_SIZE limit, so crafted HEADERS frames commit far more memory than advertised. No public exploit identified at time of analysis; impact is availability-only (CVSS 7.5) with no confidentiality or integrity effect.

Technical ContextAI

quiche is Cloudflare's Rust implementation of the QUIC transport and HTTP/3 protocols. HTTP/3 frames carry an explicit length prefix followed by a type-dependent payload; a robust parser must treat that declared length as untrusted and allocate incrementally as data actually arrives. Here the parser instead pre-sizes buffers from the declared length, embodying the CWE-770 / CWE-400 class of uncontrolled resource allocation (the input lists CWE as N/A, so this classification is inferred). The second defect is in QPACK, HTTP/3's header-compression scheme: set_max_field_section_size() is meant to cap the decompressed size of a header block, but the limit is not correctly applied, so a small compressed HEADERS frame can expand to consume disproportionate memory. The affected component per CPE is cpe:2.3:a:cloudflare:quiche across all versions prior to the fix.

RemediationAI

Vendor-released patch: upgrade quiche to 0.29.3, the earliest release containing the fix for both the frame pre-allocation and the QPACK limit-enforcement defects, and rebuild/redeploy any downstream application that vendors quiche. Follow the advisory at https://github.com/cloudflare/quiche/security/advisories/GHSA-4fgf-9xrr-88gf. Where an immediate upgrade is not possible, compensating controls include placing the HTTP/3 endpoint behind a QUIC-aware proxy or load balancer that enforces strict per-connection and per-stream memory and rate limits, tightening connection-level resource caps and lowering set_max_field_section_size() (noting this only partially helps because the flaw is that the limit is not correctly enforced), or temporarily disabling HTTP/3 and falling back to HTTP/2 over TCP - the trade-off being loss of QUIC's latency benefits and 0-RTT for clients. Constrain exposure by restricting UDP/443 reachability to trusted networks where operationally feasible.