← Vulnerability feed

Vulnerability record · CVE-2024-1765 · published 12 March 2024

CVE-2024-1765: Cloudflare quiche uncontrolled resource consumption vulnerability

Cloudflare · Quiche

Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client. A remote attacker could take advantage of this vulnerability by repeatedly sending an unlimited number of 1-RTT CRYPTO frames after previously completing the QUIC handshake. Exploitation was possible for the duration of the connection which could be extended by the attacker.  quiche 0.19.2 and 0.20.1 are the earliest versions containing the fix for this issue.

7.5 CVSS 3.1 High EPSS 1.2% · top 33.7% CWE-400 · Uncontrolled resource consumptionCWE-770 · Allocation without limits
7.5CVSS 3.1 base score
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client. A remote attacker could take advantage of this vulnerability by repeatedly sending an unlimited number of 1-RTT CRYPTO frames after previously completing the QUIC handshake. Exploitation was possible for the duration of the connection which could be extended by the attacker.  quiche 0.19.2 and 0.20.1 are the earliest versions containing the fix for this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/cloudflare/quiche/security/advisories/GHSA-78wx-jg4j-5j6g Vendor Advisory
https://github.com/cloudflare/quiche/security/advisories/GHSA-78wx-jg4j-5j6g Vendor Advisory

Track CVE-2024-1765 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2025-7054Cloudflare quiche vulnerabilityCloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_CONNECTION_ID frames. QUIC connections p…EPSS 0.40%7.5CVE-2026-12523Cloudflare quiche uncontrolled resource consumption vulnerabilitySummary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 f…EPSS 0.53%7.5CVE-2025-4821Cloudflare quiche allocation without limits vulnerabilityImpact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster th…EPSS 0.94%5.3CVE-2025-4820Cloudflare quiche allocation without limits vulnerabilityImpact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster th…EPSS 0.86%5.3CVE-2024-1410Cloudflare quiche uncontrolled resource consumption vulnerabilityCloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excess…EPSS 0.66%5.3CVE-2023-6193Cloudflare quiche uncontrolled resource consumption vulnerabilityquiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resou…EPSS 0.76%7.5CVE-2026-28318SolarWinds Serv-U unauthenticated POST request denial of serviceSolarWinds Serv-U crashes when it receives a specially crafted POST request using Content-Encoding: deflate, and the crash occurs without authenticat…KEVEPSS 1.9%analysed7.5CVE-2026-45498Microsoft Defender antimalware platform uncontrolled resource consumption DoSCVE-2026-45498 is a denial of service flaw in the Microsoft Defender antimalware platform, classified as uncontrolled resource consumption (CWE-400).…KEVEPSS 1.3%analysed

Source: NIST National Vulnerability Database (record CVE-2024-1765), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.