{"id":"GHSA-mh64-ph39-mrc9","summary":"Cloudflare Quiche: Use-after-free in connection ID iterator FFI functions","details":"### Impact\n\nCloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions.\n\nThe `quiche_connection_id_iter_next` and `quiche_conn_retired_scid_next` functions would return a pointer to a `ConnectionId` to the applications via function arguments, but the the owned `ConnectionId` would be dropped at the end of those functions' scope.\n\nOnly applications using those FFI functions are affected. The FFI API is disabled by default by a build-time feature flag.\n\nquiche 0.29.2 is the earliest version containing the fix for this issue.","aliases":["CVE-2026-11941"],"modified":"2026-06-19T22:26:27.221270Z","published":"2026-06-19T22:10:29Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-06-19T22:10:29Z","nvd_published_at":"2026-06-19T12:16:26Z","cwe_ids":["CWE-416"]},"references":[{"type":"WEB","url":"https://github.com/cloudflare/quiche/security/advisories/GHSA-mh64-ph39-mrc9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11941"},{"type":"PACKAGE","url":"https://github.com/cloudflare/quiche"}],"affected":[{"package":{"name":"quiche","ecosystem":"crates.io","purl":"pkg:cargo/quiche"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.20.0"},{"fixed":"0.29.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mh64-ph39-mrc9/GHSA-mh64-ph39-mrc9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}