GitHub Advisoryadvisory · crates.io

GHSA-78wx-jg4j-5j6g quiche vulnerable to unlimited resource allocation by QUIC CRYPTO frames flooding

MEDIUM Published 2024-03-13 Modified 2024-03-13 Official page ↗
Aliases
CVE-2024-1765
Ecosystem
crates.io
Packages
quiche
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2024-03-13

Affected packages

• crates.io quiche: < 0.19.2 → fixed in 0.19.2 • crates.io quiche: >= 0.20.0, < 0.20.1 → fixed in 0.20.1

Description

Impact Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client. A remote attacker could take advantage of this vulnerability by repeatedly sending an unlimited number of 1-RTT CRYPTO frames after previously completing the QUIC handshake. Exploitation was possible for the duration of the connection which could be extended by the attacker. Patches Quiche 0.19.2 and 0.20.1 are the earliest versions containing the fix for this issue.

Related

Alias · CVE (1)

  • CVE-2024-1765 Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References