← Vulnerability feed

Vulnerability record · CVE-2023-6193 · published 12 December 2023

CVE-2023-6193: Cloudflare quiche uncontrolled resource consumption vulnerability

Cloudflare · Quiche

quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path validation (RFC 9000 Section 8.2) requires that the recipient of a PATH_CHALLENGE frame responds by sending a PATH_RESPONSE. An unauthenticated remote attacker can exploit the vulnerability by sending PATH_CHALLENGE frames and manipulating the connection (e.g. by restricting the peer's congestion window size) so that PATH_RESPONSE frames can only be sent at the slower rate than they are received; leading to storage of path validation data in an unbounded queue. Quiche versions greater than 0.19.0 address this problem.

5.3 CVSS 3.1 Medium EPSS 0.76% · top 46.4% CWE-400 · Uncontrolled resource consumption
5.3CVSS 3.1 base score
0.76%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path validation (RFC 9000 Section 8.2) requires that the recipient of a PATH_CHALLENGE frame responds by sending a PATH_RESPONSE. An unauthenticated remote attacker can exploit the vulnerability by sending PATH_CHALLENGE frames and manipulating the connection (e.g. by restricting the peer's congestion window size) so that PATH_RESPONSE frames can only be sent at the slower rate than they are received; leading to storage of path validation data in an unbounded queue. Quiche versions greater than 0.19.0 address this problem.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://datatracker.ietf.org/doc/html/rfc9000#section-8.2 Technical Description
https://github.com/cloudflare/quiche/security/advisories/GHSA-w3vp-jw9m-f9pm Vendor Advisory
https://datatracker.ietf.org/doc/html/rfc9000#section-8.2 Technical Description
https://github.com/cloudflare/quiche/security/advisories/GHSA-w3vp-jw9m-f9pm Vendor Advisory

Track CVE-2023-6193 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2025-7054Cloudflare quiche vulnerabilityCloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_CONNECTION_ID frames. QUIC connections p…EPSS 0.40%7.5CVE-2026-12523Cloudflare quiche uncontrolled resource consumption vulnerabilitySummary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 f…EPSS 0.53%7.5CVE-2025-4821Cloudflare quiche allocation without limits vulnerabilityImpact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster th…EPSS 0.94%7.5CVE-2024-1765Cloudflare quiche uncontrolled resource consumption vulnerabilityCloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usa…EPSS 1.2%5.3CVE-2025-4820Cloudflare quiche allocation without limits vulnerabilityImpact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster th…EPSS 0.86%5.3CVE-2024-1410Cloudflare quiche uncontrolled resource consumption vulnerabilityCloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excess…EPSS 0.66%7.5CVE-2026-28318SolarWinds Serv-U unauthenticated POST request denial of serviceSolarWinds Serv-U crashes when it receives a specially crafted POST request using Content-Encoding: deflate, and the crash occurs without authenticat…KEVEPSS 1.9%analysed7.5CVE-2026-45498Microsoft Defender antimalware platform uncontrolled resource consumption DoSCVE-2026-45498 is a denial of service flaw in the Microsoft Defender antimalware platform, classified as uncontrolled resource consumption (CWE-400).…KEVEPSS 1.3%analysed

Source: NIST National Vulnerability Database (record CVE-2023-6193), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.