CVE-2026-12707

Name of the Vulnerable Software and Affected Versions quiche versions prior to 0.29.3

Description Memory resource exhaustion can occur due to the unbounded queuing of post-handshake client migration events. While the software implements protections to limit server state commitment for connection migration, the collection of PathEvents, which applications consume via the path event next() function, is not bounded. A peer can exploit rapid source address migration after the QUIC handshake to cause an unbounded queue of the PathEvent::ReusedSourceConnectionId type. This issue affects servers even if active connection migration is disabled.

Recommendations Update to version 0.29.3 or later. As a temporary mitigation, applications can call the path event next() function to drain the PathEvent collection.