quiche

⚠️ Security:

• Improves sender side handling of RETIRE_CONNECTION_ID frames. Without this an attacker could trigger an infinite loop by sending a specially-crafted set of frames that trigger a connection ID retirement (CVE-2025-7054).

Highlights:

• Added [Config::set_initial_rtt()](https://docs.rs/quiche/0.24.5/quiche/struct.Config...

⚠️ Security:

• Implemented proper ACK range validation. Without this an attacker could cause the congestion window to grow beyond typical expectations by sending ACK frames covering a large range of packet numbers, which could potentially lead to an overflow and a crash (CVE-2025-4821).
• Implemented mitigations for optimistic ACK attacks....

What's Changed

• remove unnecessary &mut by @birneee in https://github.com/cloudflare/quiche/pull/2032
• Allow queueing at least 1 millisecond worth of packets in advance. by @antoniovicente in https://github.com/cloudflare/quiche/pull/2036
• quiche: release 0.24.2 by @antoniovicente in https://github.com/cloudflare/quiche/pull/2037

New Contributors

• @birneee made their first contrib...

Breaking Changes:

• The Connection now takes a generic BufFactory. A default factory is provided, so in practice this shouldn't affect applications, but it's potentially a breaking change.

Highlights:

• Added experimental APIs for providing custom buffer...

Highlights:

• Bug fixes, mostly related to new experimental recovery implementaion.

Full changelog at https://github.com/cloudflare/quiche/compare/0.23.6...0.23.7