Defending QUIC from acknowledgement-based DDoS attacks

ACK Handling Flaws in QUIC Patched in Cloudflare's quiche

Cloudflare has patched two denial-of-service vulnerabilities in quiche, its open-source QUIC implementation, after they were reported through the company's Public Bug Bounty program on April 10, 2025. The vulnerabilities — tracked as CVE-2025-4820 and CVE-2025-4821 — affect quiche versions prior to 0.24.4 and any Cloudflare services relying on the library. Cloudflare states there is no evidence the flaws were exploited in the wild or that customers were impacted.

Both vulnerabilities stem from how quiche handles packet acknowledgements (ACKs), the feedback mechanism QUIC and other transport protocols use to confirm data delivery. An attacker exploiting these weaknesses could trick a server into artificially inflating its transmission rate, potentially leading to higher CPU utilization and network traffic amplification sufficient for DDoS conditions.

Why ACK validation matters

QUIC relies on ACKs for several critical functions: liveliness checks, loss recovery signals, and inputs to congestion control algorithms. Since ACKs carry signals that directly influence a connection's send rate, endpoints must validate them to prevent a malicious peer from gaming the system.

The first vulnerability, CVE-2025-4821, was a lack of ACK range validation. QUIC ACK frames can contain gaps and multiple ranges, and quiche previously allowed a client to acknowledge packets the server never sent — for example, acknowledging packets 0 through 100 when only 0 through 5 were transmitted. While quiche already dropped ACKs for unsent packets, the lack of validation made a second, more sophisticated attack easier to execute. The fix closes the connection when an ACK range exceeds the largest packet number the server has sent, matching the RFC 9000 recommendation that such receipts be treated as a PROTOCOL_VIOLATION.

The second issue, CVE-2025-4820, concerns what the QUIC RFC calls the "Optimistic ACK attack." Here, a client predicts the server's next packet number based on the typical monotonic sequence and sends ACKs preemptively. If the client times these artificial ACKs to arrive just as the server transmits each packet, the server perceives an artificially low round-trip time and correspondingly high bandwidth availability, causing it to ramp up its send rate beyond what the network actually supports.

Packet skipping as a countermeasure

ACK validation alone cannot stop a well-paced Optimistic ACK attack, since the malicious ACKs reference packets that do exist by the time they are processed. The QUIC RFC suggests a different defense: endpoints should occasionally skip packet numbers. Since QUIC natively supports non-sequential packet numbers, a server can omit a number and then watch for an incoming ACK that claims receipt of that skipped packet. Such an ACK is definitive proof of malicious behavior and triggers a connection close.

This approach is not available in TCP, which uses strictly sequential packet numbers. QUIC's design therefore offers a protocol-level defense that TCP implementations cannot match without additional DDoS analysis.

The challenge for implementers is deciding how often to skip. The RFC mandates that endpoints "MAY" skip packet numbers but provides no guidance on frequency. A simple approach — skipping based on a random number drawn from a static range — has drawbacks: at low send rates it would trigger too often, while at high rates it wouldn't skip often enough to be effective. Since the risk of an inflated send rate grows with throughput, the skip frequency should scale accordingly.

A CWND-aware skip strategy

The quiche fix ties skip frequency to the congestion window (CWND), the congestion control parameter determining how many bytes a connection can send per round trip. CWND grows and shrinks with the send rate, making it a natural proxy for adapting skip behavior.

// c: the current packet number
// s: range of random packet number to skip from
//
// curr_pn
//  |
//  v                 |--- (upper - lower) ---|
// [c x x x x x x x x s s s s s s s s s s s s s x x]
//    |--min_skip---| |------skip_range-------|

const DEFAULT_INITIAL_CONGESTION_WINDOW_PACKETS: usize = 10;
const MIN_SKIP_COUNTER_VALUE: u64 = DEFAULT_INITIAL_CONGESTION_WINDOW_PACKETS * 2;

let packets_per_cwnd = (cwnd / max_datagram_size) as u64;
let lower = packets_per_cwnd / 2;
let upper = packets_per_cwnd * 2;

let skip_range = upper - lower;
let rand_skip_value = rand(skip_range);

let skip_pn = MIN_SKIP_COUNTER_VALUE + lower + rand_skip_value;

With a CWND-aware skip frequency, connections at all send rates get meaningful protection against Optimistic ACK attacks. The approach balances the need for unpredictability against the secondary purpose of packet skipping: eliciting faster ACKs during loss recovery, since skipped packet numbers suppress ACK delay.

Disclosure and timeline

The vulnerabilities were reported by researchers Louis Navarre and Olivier Bonaventure of UCLouvain. Cloudflare acknowledged the report on April 10, confirmed both issues were reproducible by April 19, and completed the security patch on May 2. Infrastructure patching wrapped up on May 16, after which a new quiche version was released.

The researchers also published their findings and notified ten other QUIC implementations that were susceptible to the Optimistic ACK attack.