CVE-2026-11941 describes two use-after-free vulnerabilities in Cloudflare Quiche's connection ID iterator FFI functions: quiche_connection_id_iter_next and quiche_conn_retired_scid_next. These functions return pointers to ConnectionId objects that are dropped at the end of the function scope, leading to dereferencing freed memory. The vulnerabilities affect only applications using these FFI functions, which are disabled by default via a build-time feature flag. The impact includes undefined behavior such as process crashes (denial of service) and potential limited information disclosure or incorrect connection identifier handling. The issue is fixed starting with quiche version 0.29.2.

Applications calling the affected FFI functions in vulnerable versions may dereference freed memory, causing undefined behavior. This can result in process crashes leading to denial of service. Additionally, depending on allocator state, reads from freed memory may leak adjacent heap contents, causing limited information disclosure or incorrect connection identifier handling.

Users should upgrade to quiche version 0.29.2 or later, which contains the fix for these use-after-free vulnerabilities. The FFI API is disabled by default via a build-time feature flag, so applications not using these functions are not affected. No other mitigation is required.