CVE-2026-12523

Executive Summary

CVE-2026-12523 is a high-severity resource exhaustion vulnerability in Cloudflare's quiche library, specifically within its HTTP/3 layer. The vulnerability allows an unauthenticated, remote attacker to cause excessive memory consumption by sending specially crafted HTTP/3 frames. The issue stems from two primary flaws: (1) pre-allocation of memory based on declared frame length without verifying actual data transmission, and (2) improper enforcement of QPACK decompression limits, allowing HEADERS frames to bypass the MAX_FIELD_SECTION_SIZE constraint. This can lead to denial of service (DoS) through memory exhaustion. The fix is available in quiche version 0.29.3.

Supply Chain & Package Security

quiche is a Rust library used for QUIC and HTTP/3 protocol implementations. It is distributed via crates.io and GitHub. Organizations using quiche in their applications (e.g., proxies, CDNs, or custom servers) should treat this as a critical supply chain risk. The vulnerability is in the core HTTP/3 parsing logic, meaning any application that uses quiche to handle HTTP/3 traffic is affected. Users must update their dependency to version 0.29.3 or later. There are no known workarounds.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The threat level is High due to the low complexity of exploitation and the potential for significant service disruption. An attacker can cause memory exhaustion without authentication or user interaction.

Deep Dive & Mechanics

The vulnerability exists in quiche's HTTP/3 frame parsing logic. HTTP/3 frames have a type and a length field. The library was found to pre-allocate memory based on the declared length of certain frame types (e.g., DATA frames) before receiving the actual payload. An attacker can send a frame with a large declared length but then send only a small amount of data (or none), causing quiche to allocate memory that is never fully used. This can quickly exhaust available memory.

Additionally, the QPACK decompression logic did not properly enforce the MAX_FIELD_SECTION_SIZE limit set via set_max_field_section_size(). This allowed an attacker to send compressed HEADERS frames that, when decompressed, would exceed the advertised limit, leading to excessive memory allocation.

The attack does not require sending the full declared bytes; the memory is allocated upon parsing the frame header. This makes the attack efficient for an attacker, as a small number of crafted packets can cause significant memory consumption.

Vulnerable vs. Patched Code

The vulnerable code likely resides in the HTTP/3 frame parsing and QPACK decompression modules. The patch in version 0.29.3 introduces bounds checking and proper enforcement of limits.

Vulnerable (Conceptual):

// Vulnerable: Pre-allocates based on declared length without validation
fn parse_data_frame(len: u64) -> Vec<u8> {
    let mut buffer = Vec::with_capacity(len as usize);
    // ... read data into buffer
    buffer
}

Patched (Conceptual):

// Patched: Enforces limits and validates actual data
fn parse_data_frame(len: u64, max_len: u64) -> Result<Vec<u8>, Error> {
    if len > max_len {
        return Err(Error::FrameTooLarge);
    }
    let mut buffer = Vec::with_capacity(std::cmp::min(len, max_len) as usize);
    // ... read data into buffer with bounds checking
    Ok(buffer)
}

The exact patch details are not publicly available, but the fix involves adding checks to prevent memory pre-allocation beyond limits and enforcing QPACK decompression limits.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running quiche < 0.29.3 with HTTP/3 support.
• Network access to the target.

Exploitation Steps:

1. Establish an HTTP/3 connection to the target.
2. Send a crafted HTTP/3 frame (e.g., DATA frame) with a large declared length (e.g., 4GB) but send only a small payload.
3. Repeat step 2 multiple times to exhaust memory.

Example (using a custom script):

import socket
import struct

# Craft a simple HTTP/3 DATA frame with large declared length
def craft_malicious_frame():
    frame_type = 0x00  # DATA frame
    declared_length = 0xFFFFFFFF  # 4GB
    payload = b'\x00' * 64  # Only send 64 bytes
    frame = struct.pack('!B', frame_type) + struct.pack('!I', declared_length) + payload
    return frame

# Send over QUIC (simplified)
# Note: Actual exploitation requires a QUIC library

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for excessive memory usage in processes using quiche.
• Look for HTTP/3 connections with abnormally large frame length declarations.
• Use network monitoring to detect frames with declared length much larger than actual payload.

Mitigation:

• Immediately upgrade to quiche 0.29.3.
• Implement rate limiting on HTTP/3 connections.
• Monitor memory usage and set alerts for unusual spikes.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP/3 frames with declared length > 1MB but actual payload < 1KB.
  • Multiple HTTP/3 connections from the same source IP with large frame length declarations.
• Host IOCs:
  • High memory usage by processes using quiche (e.g., quiche or applications linked to it).
  • Logs showing OutOfMemory errors or memory allocation failed in quiche-related components.

Detection Engineering

YARA Rule

rule CVE_2026_12523_quiche_memory_exhaustion {
    meta:
        description = "Detects quiche HTTP/3 memory exhaustion attempts"
        author = "Valters IT"
        date = "2025-04-14"
        cve = "CVE-2026-12523"
    strings:
        $frame_header = { 00 [0-3] FF FF FF FF }  // DATA frame with large length
        $qpack_bypass = { 01 [0-3] [0-9A-F]{4} }  // HEADERS frame with large decompressed size
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-12523 - quiche HTTP/3 Memory Exhaustion Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2026-12523 via crafted HTTP/3 frames
author: Valters IT
date: 2025-04-14
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        app_protocol: http3
        frame_type: 0x00
        frame_length: '>= 1048576'  # 1MB
        actual_payload_length: '< 1024'
    condition: selection
falsepositives:
    - Legitimate large file transfers (unlikely with small payload)
level: high

Suricata Rule

alert http3 any any -> any any (msg:"CVE-2026-12523 - quiche HTTP/3 Memory Exhaustion Attempt"; flow:to_server; http3.frame_type; content:"|00|"; http3.frame_length; content:"|FF FF FF|"; within:4; http3.frame_payload_length; content:"|00 00 00|"; within:4; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade quiche to version 0.29.3 or later.
2. Workarounds: If upgrading is not possible, consider disabling HTTP/3 support or implementing network-level filtering to drop frames with excessive declared lengths.
3. Long-term: Implement memory limits and monitoring for HTTP/3 connections. Regularly update dependencies.

Valters IT