CVE-2024-1765 is a medium severity (CVSS 5.9) unlimited resource allocation flaw in Cloudflare quiche, the Rust QUIC and HTTP/3 library, through versions 0.19.1 and 0.20.0. A remote peer can drive memory use up. The fix is in quiche 0.19.2 and 0.20.1, so upgrade to those or anything newer.
What's affected
Cloudflare quiche through version 0.19.1 on the 0.19 line and through 0.20.0 on the 0.20 line. Both quiche servers and quiche clients are affected, according to the advisory.
The advisory says quiche 0.19.2 and 0.20.1 are the earliest versions containing the fix. If you are on 0.19.x, move to 0.19.2 at least. If you are on 0.20.0, move to 0.20.1 at least. Newer releases carry the fix as well.
The advisory rates the issue Moderate with a CVSS 3 score of 5.9. Its metrics show a network attack vector, high attack complexity, no privileges, no user interaction and a high availability impact, with no confidentiality or integrity impact. The NVD record uses the same score. The weaknesses are CWE-400 (uncontrolled resource consumption) and CWE-770 (allocation of resources without limits or throttling).
The advisory is published on the GitHub security advisory page for cloudflare/quiche, listed as GHSA-78wx-jg4j-5j6g.
How to check if you're exposed
quiche is a Rust crate, and it is also vendored into other projects, so check both direct and indirect use.
From a Rust project root, show which version resolved and what depends on it:
cargo tree -i quiche
grep -A2 'name = "quiche"' Cargo.lock
If a C or C++ project links quiche through its FFI, look at how your build fetches it, such as a git submodule or a pinned tarball, and read the version from there. Some HTTP/3 stacks embed quiche without naming it in their top level manifest, so check the lockfile of anything that speaks QUIC.
A software bill of materials makes this faster across many services. The free in-browser dependency scan can read a Cargo.lock and flag quiche versions in the affected range.
What to do now
- Run cargo tree -i quiche in each Rust service and note every version that resolves.
- Update with cargo update -p quiche, or bump the version in Cargo.toml, to 0.19.2, 0.20.1 or the latest release.
- Rebuild and redeploy. A library fix does nothing until the new binary is running.
- For vendored or embedded copies, update the upstream project that bundles quiche and check its release notes for the bump.
- Set memory limits on QUIC and HTTP/3 endpoints, with an alert on rapid growth, so a resource exhaustion issue shows up as a contained restart instead of a host outage.
Why it matters
After a QUIC handshake completes, endpoints exchange CRYPTO frames in 1-RTT packets. The advisory says that quiche did not bound how many of those frames it would accept and keep. A remote attacker could keep sending them, and memory use on the server or client rose quickly. The advisory adds that the attack worked for the whole life of the connection, which the attacker could extend.
This is a denial of service class bug. It does not leak data or run code, which explains the moderate rating. For a public HTTP/3 edge, though, an outage is still an outage, and a process that eats all memory can take down neighbours on the same host.
Nothing in the record or the advisory says this was exploited in the wild, and the Known Exploited Vulnerabilities flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which quiche versions fix CVE-2024-1765?
The advisory names 0.19.2 and 0.20.1 as the earliest fixed versions. Later releases include the fix.
Does it affect clients as well as servers?
Yes. The advisory says the memory growth can hit the system running a quiche server or a quiche client.
Sources
Last reviewed: 19 October 2026.
