NRDAX-T0182 - Optimistic ACK Congestion Window Manipulation

mechanism

quiche optimistic-ACK congestion-window growth (CVE-2025-4820): a QUIC peer completes a handshake, initiates a congestion-controlled transfer toward itself, then sends ACK frames (type 0x02 / 0x03) acknowledging packet-number ranges AHEAD of what the sender has actually sent - pacing the artificial ACKs so the server sees a very low RTT and grows its CWND without bound, admitting more bytes in flight than the path supports (availability / bandwidth amplification). CVSS 3.1 = 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Affected quiche < 0.24.4; fixed 0.24.4. public-cve-replication - wire signature only (loopback mock plays the sender; this driver plays the attacker receiver emitting the optimistic/forward ACKs). The CWND-growth impact is a property of the vulnerable congestion controller, recorded here as advisory facts, not reproduced.

instances (2)

related (Response amplification)

cite

https://nrdax.com/techniques/NRDAX-T0182

@misc{nrdax_NRDAX_T0182,
  title = {Optimistic ACK Congestion Window Manipulation (NRDAX-T0182)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0182},
}

{
  "id": "nrdax-NRDAX-T0182",
  "type": "dataset",
  "title": "Optimistic ACK Congestion Window Manipulation (NRDAX-T0182)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0182",
  "publisher": "NRDAX Registry"
}

[![NRDAX-T0182 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0182.svg)](https://nrdax.com/techniques/NRDAX-T0182-optimistic-ack-congestion-window-manipulation)