Defending QUIC from acknowledgement-based DDoS attacks

On 10 April 2025 at 12:10 UTC, a security researcher notified Cloudflare of two vulnerabilities (CVE-2025-4820 and CVE-2025-4821) related to QUIC packet acknowledgement handling in quiche, Cloudflare’s open-source QUIC implementation, affecting Cloudflare services that use it.

The researcher reported these via Cloudflare’s Public Bug Bounty program, and Cloudflare engineers patched the affected infrastructure, with the researcher confirming the DDoS vector was mitigated; Cloudflare’s investigation found no evidence the vulnerabilities were being exploited or that any customers were affected. The issues affected quiche versions prior to 0.24.4.

The post explains why ACKs are important to Internet protocol design and details the mitigation for the Optimistic ACK attack, including a dynamic CWND-aware skip frequency that scales with a connection’s send rate. A timeline notes updates from 10 April to 16 May 2025, with a new quiche version released after patching. The write-up also credits Louis Navarre and Olivier Bonaventure from UCLouvain for responsibly disclosing the issue and publishing a paper notifying 10 other QUIC implementations. According to Cloudflare’s Public Bug Bounty program.