CVE-2026-12523 Cloudflare CVE debrief

Who should care

Users of Cloudflare quiche, particularly those exposed to untrusted HTTP/3 traffic, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing system deployments, applying vendor patches, and monitoring for suspicious activity. Security teams should prioritize patching and review compensating controls for exposed systems. Operators of affected systems should verify system exposure, review vendor guidance, and monitor for suspicious HTTP/3 frame traffic.

Technical summary

Cloudflare quiche's HTTP/3 layer is vulnerable to resource exhaustion through specially crafted HTTP/3 frames. The issue arises from pre-allocating memory based on declared frame length and not applying QPACK decompression limits correctly, allowing for potential memory commitment beyond advertised limits. This could enable an attacker to cause resource exhaustion, potentially leading to denial-of-service conditions. The vulnerability is rated HIGH with a CVSS score of 7.5, indicating a serious vulnerability in Cloudflare quiche's HTTP/3 layer.

Defensive priority

CVE-2026-12523 is rated HIGH with a CVSS score of 7.5, indicating a serious vulnerability in Cloudflare quiche's HTTP/3 layer that could lead to resource exhaustion through specially crafted HTTP/3 frames.

Recommended defensive actions

• Upgrade to quiche version 0.29.3 or later to address the vulnerability
• Review and apply QPACK decompression limits correctly
• Monitor for and restrict suspicious HTTP/3 frame traffic
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry detail a vulnerability in Cloudflare quiche's HTTP/3 layer that could lead to resource exhaustion via specially crafted frames. The issue involves improper memory pre-allocation based on frame length and incorrect application of QPACK decompression limits. Evidence is limited to CVE and NVD entries. Defenders should verify system exposure, review vendor guidance, and monitor for suspicious HTTP/3 frame traffic.

Official resources