QPACK header decompression amplification in Cloudflare quiche
Cloudflare quiche fails to cap QPACK header decompression output, allowing an unauthenticated attacker to send a small compressed payload that expands 600-4000x in memory, causing denial of service.
- Vendor
- Cloudflare
- Product
- quiche (before 0.29.3)
- CVSS
- 7.5
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Is CVE-2026-12523 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-12523 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-22 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 21, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison
CVE-2026-12523 timeline
- Published to NVD
- First 0dayNews coverage+100d
- Patch available+100dFixed in Cloudflare quiche 0.29.3
- Public proof-of-concept+100dFoxIO released proof-of-concept code alongside disclosure
- Vendor advisory+100dFoxIO disclosed QPACK amplification bug; quiche 0.29.3 released
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Cloudflare quiche, a Rust-based QUIC and HTTP/3 library, contains a flaw in its QPACK header decompression handling. QPACK allows HTTP/3 implementations to reference previously stored header entries using compact references. Affected versions of quiche cap the size of the compressed input on the wire but do not enforce a limit on the decompressed output.
An unauthenticated attacker can store a large header entry and reference it repeatedly within a single connection, causing the server to rebuild the full entry each time. FoxIO, the security firm that disclosed the issue, measured up to 4,000x memory amplification in affected implementations. The resulting memory pressure can crash the server process.
No authentication or established session is required to trigger the condition. No active exploitation in the wild has been reported.
Affected versions: Cloudflare quiche before 0.29.3
Fix: Upgrade to quiche 0.29.3.
Related QPACK amplification CVEs exist in quic-go (CVE-2025-64702, CVSS 5.3) and Wireshark (CVE-2025-13945, CVSS 5.5). Bun, h3, and aioquic remain unpatched as of the disclosure date.
