« Volver al listado

CVE-2025-4821

Estado: AnalizadaAlta (7.5)—

Impact

Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.

An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames covering a large range of packet numbers (including packet numbers that had never been sent); see RFC 9000 Section 19.3.

Leer descripción completaMostrar menos

The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support. In extreme cases, the window might grow beyond the limit of the internal variable's type, leading to an overflow panic.

Patches

quiche 0.24.4 is the earliest version containing the fix for this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Ataque remoto sin autenticación (AV:N, PR:N, UI:N) contra servicio QUIC expuesto. Manipulación de ACKs causa desbordamiento de ventana de congestión y pánico, resultando en denegación de servicio (CWE-770, A:H).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Cloudflare — Quiche

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-4821",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-4821",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-18T18:29:42.416230Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@cloudflare.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@cloudflare.com",
      "affectedData": [
        {
          "vendor": "Cloudflare",
          "product": "quiche",
          "versions": [
            {
              "status": "affected",
              "version": "<0.24.4"
            }
          ],
          "packageName": "cloudflare-quiche",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-06-18T16:15:28.527",
  "references": [
    {
      "url": "https://github.com/cloudflare/quiche/security/advisories/GHSA-6m38-4r9r-5c4m",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@cloudflare.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@cloudflare.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Impact\n\nCloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.\n\nAn unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames covering a large range of packet numbers (including packet numbers that had never been sent); see RFC 9000 Section 19.3. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support. In extreme cases, the window might grow beyond the limit of the internal variable's type, leading to an overflow panic.\n\n\n\nPatches\n\n\nquiche 0.24.4 is the earliest version containing the fix for this issue."
    },
    {
      "lang": "es",
      "value": "Se descubrió que Quiche de Cloudflare era vulnerable a un crecimiento incorrecto de la ventana de congestión, lo que podría provocar el envío de datos a una velocidad superior a la que la ruta realmente admite. Un atacante remoto no autenticado puede explotar esta vulnerabilidad completando primero un protocolo de enlace e iniciando una transferencia de datos controlada por congestión hacia sí mismo. Posteriormente, podría manipular el estado de control de congestión de la víctima enviando tramas ACK que abarcan una amplia gama de números de paquetes (incluidos los que nunca se enviaron); consulte la sección 19.3 de RFC 9000. La víctima podría ampliar la ventana de congestión más allá de lo esperado y permitir más bytes en tránsito de los que la ruta realmente admite. En casos extremos, la ventana podría sobrepasar el límite del tipo de la variable interna, lo que provocaría un pánico por desbordamiento. Parches: Quiche 0.24.4 es la versión más antigua que contiene la solución para este problema."
    }
  ],
  "lastModified": "2026-06-17T09:34:05.217",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cloudflare:quiche:*:*:*:*:*:rust:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DAD3DB7-C853-47F1-91E3-BB4B1238498C",
              "versionEndExcluding": "0.24.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@cloudflare.com"
}