CVE-2026-12707

Executive Summary

CVE-2026-12707 is a high-severity (CVSS 7.5) vulnerability in Cloudflare’s quiche library, an implementation of the QUIC transport protocol (RFC 9000). The flaw resides in the handling of connection migration events. After the QUIC handshake completes, an attacker can rapidly change the source address (source address migration) to cause unbounded queuing of PathEvent::ReusedSourceConnectionId events. This leads to memory resource exhaustion, effectively a denial-of-service (DoS) condition. The vulnerability affects servers even if active connection migration is disabled. The official patch is included in quiche version 0.29.3. As a temporary mitigation, applications can drain the PathEvent collection by calling path_event_next().

Supply Chain & Package Security

This vulnerability affects the quiche library, which is distributed as a Rust crate via crates.io. Organizations using quiche as a dependency in their Rust projects should immediately update to version 0.29.3 or later. The supply chain risk is moderate, as the library is widely used in QUIC implementations, including Cloudflare’s own infrastructure. No malicious package injection has been reported, but the unbounded memory consumption can be triggered by any peer.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The threat level is High due to the low complexity of exploitation and the potential for complete denial of service. No authentication or user interaction is required.

Deep Dive & Mechanics

QUIC (RFC 9000) supports connection migration, allowing a connection to survive changes in the network path (e.g., switching from Wi-Fi to cellular). Section 9.3 of RFC 9000 describes protections to limit server state commitment during migration. However, quiche’s implementation of the PathEvent collection was unbounded.

When a client sends a packet with a new source address after the handshake, quiche generates a PathEvent::ReusedSourceConnectionId event. These events are queued for the application to consume via path_event_next(). An attacker can rapidly send packets from many different source addresses, causing the queue to grow without limit. This consumes server memory, leading to resource exhaustion and denial of service.

The vulnerability is particularly dangerous because:

• It requires no authentication.
• It works even if the server has disabled active connection migration.
• The attack can be performed with minimal bandwidth.

Vulnerable vs. Patched Code

The vulnerable code (pre-0.29.3) does not enforce a limit on the number of PathEvent items queued. The patched code (0.29.3) introduces a cap on the queue size, preventing unbounded growth.

Vulnerable (pseudo-code):

fn on_migration_event(event: PathEvent) {
    self.path_events.push_back(event); // No size check
}

Patched (pseudo-code):

fn on_migration_event(event: PathEvent) {
    if self.path_events.len() < MAX_PATH_EVENTS {
        self.path_events.push_back(event);
    } else {
        // Drop or log the event
    }
}

The exact patch can be found in the quiche repository. The constant MAX_PATH_EVENTS is set to a reasonable limit (e.g., 1024).

Exploitation & Lab Setup

Red Team

Prerequisites:

• A QUIC client capable of sending packets with arbitrary source addresses.
• Target server running quiche < 0.29.3.

Exploitation Steps:

1. Complete the QUIC handshake with the target server.
2. After handshake, send a series of QUIC packets, each with a different source IP address (or UDP port). The packets should be valid QUIC short-header packets that trigger a path validation attempt.
3. The server will queue a PathEvent::ReusedSourceConnectionId for each new source address.
4. Continue sending packets with new source addresses until the server’s memory is exhausted.

Example using a custom script (conceptual):

import socket
import struct

# Assume quic_handshake() returns a connection object
conn = quic_handshake(target_ip, target_port)
for i in range(100000):
    # Spoof source address (requires raw socket or proxy)
    packet = build_quic_packet(conn, src_ip=f"10.0.0.{i % 256}")
    send_packet(target_ip, target_port, packet)

Note: This is a conceptual example. Actual exploitation requires a QUIC library that allows source address spoofing.

Blue Team

Detection:

• Monitor memory usage of quiche processes. A sudden spike in memory consumption after a QUIC handshake is a strong indicator.
• Monitor for a high rate of PathEvent::ReusedSourceConnectionId events in application logs.
• Use network monitoring to detect a single client sending packets from many different source IPs/ports.

Mitigation:

• Immediately upgrade to quiche 0.29.3.
• As a workaround, ensure the application calls path_event_next() frequently to drain the event queue.
• Implement rate limiting on connection migration events at the application layer.

Indicators of Compromise (IOCs)

• Network: High volume of QUIC packets from a single client with rapidly changing source IP addresses or UDP ports.
• Host: Excessive memory consumption by a process using quiche.
• Logs: Repeated PathEvent::ReusedSourceConnectionId entries in application logs.
• File: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2026_12707_quiche_memory_exhaustion {
    meta:
        description = "Detects quiche library versions vulnerable to CVE-2026-12707"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-12707"
    strings:
        $quiche_lib = "quiche" nocase
        $version_old = { 30 2e 32 39 2e [0-2] } // matches 0.29.0, 0.29.1, 0.29.2
    condition:
        $quiche_lib and $version_old
}

Sigma Rule

title: CVE-2026-12707 - Quiche Memory Exhaustion via PathEvent
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects excessive PathEvent::ReusedSourceConnectionId events in quiche logs
author: Valters IT
date: 2025-04-10
logsource:
    product: application
    service: quiche
detection:
    selection:
        EventID: "PathEvent::ReusedSourceConnectionId"
    condition: selection | count() by src_ip > 1000 within 60 seconds
falsepositives:
    - Legitimate high-mobility clients (e.g., mobile devices)
level: high

Suricata Rule

alert udp any any -> any 443 (msg:"CVE-2026-12707 - Quiche PathEvent Flood"; content:"|c0|"; offset:0; depth:1; content:"|ff|"; within:1; detection_filter:track by_src, count 1000, seconds 60; sid:1000001; rev:1;)

Note: This Suricata rule is a simplified example. QUIC detection requires deep packet inspection (DPI) and may not be feasible with standard rules.

Remediation & Mitigation

Immediate:

• Upgrade to quiche 0.29.3 or later.
• If upgrade is not possible, ensure the application calls path_event_next() in a loop to drain the event queue.

Long-term:

• Implement application-level rate limiting on connection migration events.
• Monitor memory usage and set alerts for abnormal growth.
• Review QUIC implementation for similar unbounded queues.

Patch Details:

• The fix is included in quiche 0.29.3. Users should update their Cargo.toml to quiche = ">=0.29.3".

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert