EUVD-2025-18651
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Tags
Description
Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support. An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames covering a large range of packet numbers (including packet numbers that had never been sent); see RFC 9000 Section 19.3. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support. In extreme cases, the window might grow beyond the limit of the internal variable's type, leading to an overflow panic. Patches quiche 0.24.4 is the earliest version containing the fix for this issue.
Analysis
Cloudflare quiche, a QUIC protocol implementation, contains a congestion control vulnerability (CVE-2025-4821) where an unauthenticated remote attacker can manipulate ACK frames to artificially inflate the congestion window beyond safe limits, causing excessive data transmission rates and potential denial of service through integer overflow panics. The vulnerability affects quiche versions prior to 0.24.4. While the CVSS score is 7.5 (high severity with network attack vector and no privileges required), real-world exploitation requires completing a QUIC handshake and active manipulation, limiting opportunistic exploitation.
Technical Context
Cloudflare quiche is a QUIC protocol implementation (RFC 9000 compliant). The vulnerability stems from improper congestion window (cwnd) growth logic in the congestion control state machine. Specifically, the implementation fails to properly validate ACK frame packet number ranges before applying congestion window increases. RFC 9000 Section 19.3 defines ACK semantics—legitimate ACKs should only reference previously sent packets. The vulnerability exploits this by sending ACK frames covering packet numbers that were never transmitted, causing the victim's congestion control algorithm to grow the cwnd excessively. This is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), where the congestion window resource is allocated without proper bounds checking. The root cause is missing validation of packet number ranges in ACK processing before applying congestion control window growth calculations. Affected CPE: cpe:2.3:a:cloudflare:quiche:*:*:*:*:*:*:*:* (versions < 0.24.4).
Affected Products
quiche (< 0.24.4)
Remediation
Primary Patch: Upgrade Cloudflare quiche to version 0.24.4 or later; verification: Confirm version via quiche --version or cargo tree (if building from source); references: Cloudflare Security Advisory (expected at https://github.com/cloudflare/quiche or security page) Interim Mitigation: If immediate patching is not possible: (1) Rate-limit QUIC connections per source IP; (2) Monitor for abnormal ACK packet patterns (ACKs referencing unsent packet numbers); (3) Implement stricter packet number validation in ACK processing; (4) Deploy connection-level resource limits (max cwnd cap regardless of ACK claims); effectiveness: Partial—slows exploitation but does not eliminate vulnerability Detection: Monitor application logs for panic/crash errors in quiche congestion control; correlate with QUIC connection termination patterns; alert on ACK frames with anomalously high packet number ranges; effectiveness: Reactive—detects active exploitation attempts
Priority Score
Vendor Status
Debian
Bug #841848| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
Share
External POC / Exploit Code
Leaving vuln.today