What is the CVSS score of CVE-2026-12707?

CVE-2026-12707 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Cloudflare quiche are affected by CVE-2026-12707?

Cloudflare quiche versions before 0.29.3 contain a denial-of-service vulnerability that allows unauthenticated remote attackers to exhaust server memory and crash services.. A patch is available.

How to fix or mitigate CVE-2026-12707?

Within 24 hours, inventory all systems running Cloudflare quiche to identify version numbers and exposure; consult Cloudflare documentation and internal architecture records to map vulnerable deployments. Within 7 days, implement compensating controls including per-connection memory limits configured in the application, network traffic rate limiting where detectable, and active monitoring of memory consumption with alerting thresholds on affected servers. Within 30 days, monitor Cloudflare's security advisories for patch release information; establish upgrade testing and deployment plan for patched versions (0.29.3 or later) when available.

Cloudflare quiche CVE-2026-12707

EUVD-2026-43716 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-14 cloudflare

Denial Of Service Quiche

7.5

CVSS 3.1 · Vendor: cloudflare

Severity by source

Vendor (cloudflare) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote, low-complexity, unauthenticated post-handshake migration flood; availability-only impact with no confidentiality or integrity effect, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cloudflare).

CVSS VectorVendor: cloudflare

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 14, 2026 - 18:20 EUVD

Analysis Generated

Jul 14, 2026 - 16:06 vuln.today

CVE Published

Jul 14, 2026 - 15:18 cve.org

HIGH 7.5

DescriptionCVE.org

Summary

Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events.

Impact

quiche supports the connection migration features described in Section 9 of RFC 9000, which allows a single QUIC connection to survive changes in the network path. Although quiche implements the protections described in Section 9.3 of RFC 9000 to limit server state commitment, it was discovered that the collection of PathEvents, intended to be consumed by applications via the path_event_next() function, was not bounded.

Once the QUIC handshake completed, a peer could exploit rapid source address migration in order to cause unbounded queuing of the PathEvent::ReusedSourceConnectionId type. Servers are vulnerable even if active connection migration is disabled.

Mitigation:

Applications can call path_event_next() to drain the PathEvent collection, mitigating the attack.

Users are requested to upgrade to quiche 0.29.3 which is the earliest version that prevents excessive queueing of PathEvent::ReusedSourceConnectionId.

AnalysisAI

Denial of service in Cloudflare quiche (all versions before 0.29.3) allows a remote unauthenticated peer to exhaust server memory by triggering rapid post-handshake source address migration, causing unbounded queuing of PathEvent::ReusedSourceConnectionId entries in the internal PathEvents collection. Because the queue grows without limit whenever an application does not drain it via path_event_next(), an attacker can force high memory consumption and crash or degrade the server; notably, servers remain vulnerable even when active connection migration is disabled. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

quiche is Cloudflare's Rust implementation of the QUIC transport protocol and HTTP/3, used as a library embedded in servers and proxies. It implements RFC 9000 Section 9 connection migration, which lets a QUIC connection survive changes in the client's network path (IP/port), and the Section 9.3 protections that limit how much server state an unvalidated new path can commit. The flaw is a CWE-770 (Allocation of Resources Without Limits or Throttling) condition: PathEvent objects - specifically PathEvent::ReusedSourceConnectionId events generated on source address change - are appended to a collection meant to be consumed by the embedding application through path_event_next(), but that collection has no upper bound. A peer that rapidly cycles its source address after the handshake generates these events faster than (or without) the application draining them, so memory grows without limit.

RemediationAI

Vendor-released patch: quiche 0.29.3, which is the earliest version that prevents excessive queuing of PathEvent::ReusedSourceConnectionId; upgrade the quiche dependency to 0.29.3 or later and rebuild/redeploy affected services, per the advisory at https://github.com/cloudflare/quiche/security/advisories/GHSA-4q5x-gp38-rfp4. If immediate upgrade is not possible, the application-level workaround is to ensure the embedding application promptly and continuously drains the PathEvent collection by calling path_event_next() in its event loop so events cannot accumulate unbounded - the trade-off is that this requires an application code change and correct handling under load, and any gap or backpressure in that drain loop re-exposes the memory growth. Note that disabling active connection migration is NOT an effective mitigation, since servers remain vulnerable even with migration disabled. As additional compensating controls, restrict or rate-limit QUIC/UDP exposure to untrusted clients and monitor per-process memory to detect and recycle affected instances before exhaustion.