Defending QUIC from acknowledgement-based DDoS attacks

What this post added

This post details the identification and mitigation of two vulnerabilities (CVE-2025-4820 and CVE-2025-4821) in the quiche library related to QUIC packet acknowledgement handling. The mitigation involves enforcing ACK range validation based on the largest packets sent by the server and implementing a dynamic CWND-aware skip frequency to counter Optimistic ACK attacks, thereby preventing DDoS vectors caused by artificially expanded send rates.