U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database

Vulnerability Change Records for CVE-2024-1765

Change History

New CVE Received by NIST 3/12/2024 2:15:07 PM

Action Type Old Value New Value
Added CVSS V3.1 

								
							
							
								
							
						
								
							
								
Cloudflare, Inc. AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

								
								
					

					

						Added
						CWE
						
							
							
								
							
								

								
							
							
								
							
						
								
							
								
Cloudflare, Inc. CWE-400

								
								
					

					

						Added
						CWE
						
							
							
								
							
								

								
							
							
								
							
						
								
							
								
Cloudflare, Inc. CWE-770

								
								
					

					

						Added
						Description
						
							
							
								
							
								

								
							
							
								
							
						
								
							
								
Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client.
A remote attacker could take advantage of this vulnerability by repeatedly sending an unlimited number of 1-RTT CRYPTO frames after previously completing the QUIC handshake.
Exploitation was possible for the duration of the connection which could be extended by the attacker. 
quiche 0.19.2 and 0.20.1 are the earliest versions containing the fix for this issue.



								
								
					

					

						Added
						Reference
						
							
							
								
							
								

								
							
							
								
							
						
								
							
								
Cloudflare, Inc. https://github.com/cloudflare/quiche/security/advisories/GHSA-78wx-jg4j-5j6g [No types assigned]