CVE-2026-11941

Name of the Vulnerable Software and Affected Versions Cloudflare Quiche versions prior to 0.29.2

Description Two use-after-free issues exist in the connection ID iterator FFI (Foreign Function Interface) functions. The functions quiche connection id iter next() and quiche conn retired scid next() return a pointer to a ConnectionId via function arguments, but the owned ConnectionId is dropped at the end of the function scope. This affects only applications using these FFI functions, which are disabled by default via a build-time feature flag. Exploitation leads to dereferencing freed memory, typically resulting in undefined behavior and process crashes (denial of service), or potentially limited information disclosure and incorrect connection identifier handling depending on the allocator state.

Recommendations Upgrade to version 0.29.2 or later. As a temporary workaround, disable the FFI API using the build-time feature flag.