The vulnerability resides in Cloudflare's quiche HTTP/3 implementation, where parsing certain frame types incorrectly pre‑allocates memory based on a declared length. An attacker can craft frames to trigger this behavior without sending the full payload, leading to uncontrolled memory allocation. Additionally, the QPACK decompression limits are not applied correctly, allowing oversized HEADERS frames that exceed the configured MAX_FIELD_SECTION_SIZE. The resulting memory exhaustion can cause a denial of service against the affected server or client, potentially degrading performance or crashing the process.

Any application, library or server that integrates Cloudflare's quiche library for HTTP/3 is affected. All releases prior to quiche 0.29.3 are vulnerable.

The CVSS score of 7.5 classifies it as high severity. The EPSS score of < 1% indicates a low probability of widespread exploitation at the time of analysis, and it is not listed in the CISA KEV catalog. The advisory does not specify whether authentication or credentials are required to exploit the vulnerability; based on the description, an attacker can send malicious HTTP/3 frames to any quiche‑enabled endpoint, but the exact authentication requirement remains unclear. The primary risk is that the attacker can force the target to allocate large amounts of memory, potentially exhausting resource limits and causing a service interruption.