CVE-2026-11941Medium· 5.6▾ SunlitCloudflare Quiche: Use-after-free in connection ID iterator FFI functions
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions.
The quiche_connection_id_iter_next and quiche_conn_retired_scid_next functions would return a pointer to a ConnectionId to the applications via function arguments, but the the owned ConnectionId would be dropped at the end of those functions' scope.
Only applications using those FFI functions are affected. The FFI API is disabled by default by a build-time feature flag.
quiche 0.29.2 is the earliest version containing the fix for this issue.
quiche >= 0.20.0, < 0.29.2Upgrade to a patched release:
quiche 0.29.2Connected by shared product, vendor, weakness, or advisory.
CVE-2024-1410Low· 3.7quiche vulnerable to unbounded storage of information related to connection ID retirement
CVE-2023-6193Medium· 5.3Unbounded queuing of path validation messages in cloudflare-quiche
CVE-2024-1765Medium· 5.9quiche vulnerable to unlimited resource allocation by QUIC CRYPTO frames flooding
CVE-2022-3256High· 7.8Use After Free in GitHub repository vim/vim prior to 9.0.0530.
CVE-2022-3134High· 7.8Use After Free in GitHub repository vim/vim prior to 9.0.0389.
CVE-2022-3297High· 7.8Use After Free in GitHub repository vim/vim prior to 9.0.0579.