https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 21:35:15 +0000 https://cve.radiocsirt.org/vuln/cve-2026-11941 <p><strong>Affected:</strong> Cloudflare Quiche</p> <p>Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions.</p> <p>The “quiche_connection_id_iter_next” and “quiche_conn_retired_scid_next” functions would return a pointer to a “ConnectionId” to the applications via function arguments, but the owned “ConnectionId” would be dropped at the end of those functions&#39; scope.</p> <p>Only applications using those FFI functions are affected. The FFI API is disabled by default by a build-time feature flag.</p> <p>Impact If unpatched, an application calling the affected FFI functions will dereference freed memory. The most likely outcome is undefined behavior leading to a process crash (denial of service). Depending on allocator state, the read may also return adjacent heap contents, resulting in limited information disclosure or incorrect connection identifier handling.</p> <p>Mitigation Users are requested to upgrade to quiche 0.29.2 which is the earliest version containing the fix for this issue.</p> <p><strong>Affected:</strong> Cloudflare Quiche</p> <p>Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions.</p> <p>The “quiche_connection_id_iter_next” and “quiche_conn_retired_scid_next” functions would return a pointer to a “ConnectionId” to the applications via function arguments, but the owned “ConnectionId” would be dropped at the end of those functions&#39; scope.</p> <p>Only applications using those FFI functions are affected. The FFI API is disabled by default by a build-time feature flag.</p> <p>Impact If unpatched, an application calling the affected FFI functions will dereference freed memory. The most likely outcome is undefined behavior leading to a process crash (denial of service). Depending on allocator state, the read may also return adjacent heap contents, resulting in limited information disclosure or incorrect connection identifier handling.</p> <p>Mitigation Users are requested to upgrade to quiche 0.29.2 which is the earliest version containing the fix for this issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-11941