Cloudflare quiche Congestion Control Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Cloudflare quiche versions prior to 0.24.4. The issue arises from incorrect congestion window growth, allowing an unauthenticated remote attacker to send data faster than the network path can support. Exploitation involves completing a handshake and initiating a congestion-controlled data transfer, followed by sending ACK frames that manipulate the victim's congestion control state. This can cause the congestion window to exceed normal limits, potentially leading to an overflow panic.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition by overwhelming the application's congestion control mechanism, leading to a panic due to an overflow.

Remediation

Users can upgrade to Cloudflare quiche version 0.24.4 or later to address this vulnerability.