What is CVE-2024-1765?

CVE-2024-1765 is a medium-severity vulnerability in Cloudflare Quiche, classified under Uncontrolled Resource Consumption. CVSS score: 5.9/10. Published 2024-03-12.

How severe is CVE-2024-1765?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Resource exhaustion in Cloudflare Quiche

CVE-2024-1765

Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client. A remote attacker could take advantage of this vulnerability by repeatedly sending an unlimited number of 1-RTT CRYPTO frames after previously completing the QUIC handshake. Exploitation was possible for the duration of the connection which could be extended by the attacker. quiche 0.19.2 and 0.20.1 are the earliest versions containing the fix for this issue.

Vulnerability class: DoS (Denial of Service)

Published 2024-03-12 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.012 (66.3th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 66th percentile — 66.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000

Affected products

Cloudflare Quiche — versions 0.15.0, 0.20.0

Weakness classification (CWE)

References

github.com/cloudflare/quiche/security/advisories/GHSA-78wx-jg4j-5j6g (Vendor Advisory)

Frequently asked questions

What is CVE-2024-1765?: CVE-2024-1765 is a medium-severity vulnerability in Cloudflare Quiche, classified under Uncontrolled Resource Consumption. CVSS score: 5.9/10. Published 2024-03-12.
How severe is CVE-2024-1765?: Medium severity. CVSS v3 base score is 5.9 out of 10.