{"answers":{"affected":"2 open source packages ship an affected version, including quiche.","exploited":"There is no known exploitation of CVE-2026-11941 in the wild and no public exploit code.","fix":"Upgrade quiche to 0.29.2 or later.","what":"CVE-2026-11941 is a medium-severity use after free vulnerability in Cloudflare Quiche, published on 19 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-11941 and fix it if it is affected.\n\nWhat it is: CVE-2026-11941 is a medium-severity use after free vulnerability in Cloudflare Quiche, published on 19 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-11941 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- quiche (crates.io): affected from 0.20.0; fixed in 0.29.2\n- quiche (crates.io): affected from 0.20.0; fixed in 0.29.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-11941/ (Markdown: https://insights.sbomify.com/CVE-2026-11941/index.md)","id":"CVE-2026-11941","markdown":"https://insights.sbomify.com/CVE-2026-11941/index.md","name":"CVE-2026-11941","record":{"aliases":["GHSA-mh64-ph39-mrc9"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service","data_read"],"network_reachable":"yes","non_default_config":true,"product_category":"Quiche QUIC library","requires_auth":"none","summary":"Applications using disabled-by-default FFI functions in Quiche may crash or leak memory due to use-after-free errors.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"cloudflare","cpe":[],"cvss":{"score":5.6,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions.\n\nThe “quiche_connection_id_iter_next” and “quiche_conn_retired_scid_next” functions would return a pointer to a “ConnectionId” to the applications via function arguments, but the owned “ConnectionId” would be dropped at the end of those functions' scope.\n\nOnly applications using those FFI functions are affected. The FFI API is disabled by default by a build-time feature flag.\n\nImpact\nIf unpatched, an application calling the affected FFI functions will dereference freed memory. The most likely outcome is undefined behavior leading to a process crash (denial of service). Depending on allocator state, the read may also return adjacent heap contents, resulting in limited information disclosure or incorrect connection identifier handling.\n\nMitigation\nUsers are requested to upgrade to quiche 0.29.2 which is the earliest version containing the fix for this issue.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Use-after-free in connection ID iterator and FFI functions","id":"CVE-2026-11941","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":2,"n_references":1,"next":{"headline":"Akaunting 3.1.21 - Stored XSS in delete confirmation modal","id":"CVE-2026-11942"},"packages":[{"ecosystem":"crates.io","fixed":["0.29.2"],"introduced":["0.20.0"],"last_affected":[],"package":"quiche","purl":null,"source":"GHSA-mh64-ph39-mrc9"},{"ecosystem":"crates.io","fixed":["0.29.2"],"introduced":["0.20.0"],"last_affected":[],"package":"quiche","purl":"pkg:cargo/quiche","source":"GHSA-mh64-ph39-mrc9"}],"prev":{"headline":"tarfile extraction filter bypass allows escaping the destination directory","id":"CVE-2026-11940"},"products":["Quiche"],"published":"2026-06-19","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-06-22","vendors":["Cloudflare"]},"summary":"Applications using disabled-by-default FFI functions in Quiche may crash or leak memory due to use-after-free errors.","url":"https://insights.sbomify.com/CVE-2026-11941/"}