Marten Seeman

The issue is related to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers (IDs). Endpoints declare the number of active connection IDs they are willing to support using the `active connection id limit` transport parameter. The peer can create new IDs using a "NEW CONNECTION ID" frame but must stay within the active ID limit. This is done by retirement of old IDs, the endpoint sends "NEW CONNECTION ID" includes a value in the `retire prior to` field, which elicits a "RETIRE CONNECTION ID" frame as confirmation. An unauthenticated remote attacker can exploit the issue by sending "NEW CONNECTION ID" frames and manipulating the connection so that "RETIRE CONNECTION ID" frames can only be sent at a slower rate than they are received, leading to storage of information related to connection IDs in an unbounded queue.

The issue is related to an unlimited resource allocation vulnerability, causing a rapid increase in memory usage of the system running the quiche server or client. A remote attacker could exploit this by repeatedly sending an unlimited number of 1-RTT CRYPTO frames after completing the QUIC handshake. Exploitation was possible for the duration of the connection, which could be extended by the attacker.