CVE-2026-11941Medium· 5.6▾ SunlitCloudflare Quiche: Use-after-free in connection ID iterator FFI functions
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.3%
Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions.
The quiche_connection_id_iter_next and quiche_conn_retired_scid_next functions would return a pointer to a ConnectionId to the applications via function arguments, but the the owned ConnectionId would be dropped at the end of those functions' scope.
Only applications using those FFI functions are affected. The FFI API is disabled by default by a build-time feature flag.
quiche 0.29.2 is the earliest version containing the fix for this issue.
quiche >= 0.20.0, < 0.29.2Upgrade to a patched release:
quiche 0.29.2Connected by shared product, vendor, weakness, or advisory.
CVE-2024-1410Low· 3.7quiche vulnerable to unbounded storage of information related to connection ID retirement
CVE-2023-6193Medium· 5.3Unbounded queuing of path validation messages in cloudflare-quiche
CVE-2024-1765Medium· 5.9quiche vulnerable to unlimited resource allocation by QUIC CRYPTO frames flooding
CVE-2022-1734High· 7.0A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.
CVE-2022-1011High· 7.8A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write()
CVE-2023-25747High· 7.5A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30. *This bug only affects Firefox for Android