Defending QUIC from acknowledgement-based DDoS attacks
Oct 29, 2025Apoorv Kothari, Louis Navarre
Summary
This post details the identification and mitigation of two vulnerabilities (CVE-2025-4820 and CVE-2025-4821) in the quiche library related to QUIC packet acknowledgement handling. The mitigation involves enforcing ACK range validation based on the largest packets sent by the server and implementing a dynamic CWND-aware skip frequency to counter Optimistic ACK attacks, thereby preventing DDoS vectors caused by artificially expanded send rates.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack