CVE-2026-12708

Summary Cloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAGRAM handling. For every previously unseen flow identifier (quarter stream ID) received in a DATAGRAM frame, tokio-quiche creates and retains new, per-flow state. A remote peer can send DATAGRAMs with many distinct identifiers, causing the per-connection flow map and associated channel state to grow without bound. Impact Exploitation can exhaust process memory and cause a denial of service. The vulnerable code is used in both client and server configurations, so either role can be affected by a malicious peer. QUIC DATAGRAM support in tokio-quiche is enabled by default through QuicSettings::enable_dgram; applications can disable it by setting this field to false. The vulnerable HTTP/3 path is reachable only when DATAGRAM support is negotiated with the peer. Core quiche and HTTP/3 deployments without DATAGRAM support are not affected.  Mitigation Disable DATAGRAMs in tokio-quiche’s QuicSettings::enable_dgram. Remediation Upgrade to tokio-quiche version 0.23.0 or later. The fixed code creates flow state only for valid DATAGRAM-capable request streams, which are bounded by QUIC’s stream limits. To tolerate packet reordering, servers retain early DATAGRAMs in a bounded, expiring buffer, while clients discard DATAGRAMs for unknown flows.

• CWE-401

• https://github.com/cloudflare/quiche/security/advisories/GHSA-wcm9-jv39-r963
• https://www.cve.org/CVERecord?id=CVE-2026-12708

Published

Nov 10, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-127074OpsTree BuildPiper before 2.7.0 contains a path traversal vu…4.3
• CVE-2026-127075OpsTree BuildPiper before 2.7.0 contains a path traversal vu…6.5
• CVE-2026-127076OpsTree BuildPiper before 2.7.0 contains a broken access con…6.5
• CVE-2026-127077OpsTree BuildPiper before 2.7.0 contains an authorization by…7.1
• CVE-2026-127078OpsTree BuildPiper before 2.7.0 contains an authorization by…7.1
• CVE-2026-127079OpsTree BuildPiper before 2.7.0 lacks rate limiting on passw…7.4
• CVE-2026-127080OpsTree BuildPiper before 2.7.0 contains an improper authori…9.9
• CVE-2026-127081OpsTree BuildPiper before 2.7.0 contains an authorization by…4.3
• CVE-2026-127082Huginn before 2026.11.09 contains an information exposure vu…7.7
• CVE-2026-127083Huginn from 2026.09.09 before 2026.11.09 contains a server-s…6.4
• CVE-2026-127084Teable before 2026-10-12T12-45-53Z.3331 contains a stored cr…7.3
• CVE-2026-127085Ryot before 10.5.6 contains an authorization bypass vulnerab…4.3