Unbounded memory growth via oversized QUIC posthandshake messages
CVE-2023-39322 Published on September 8, 2023
Memory exhaustion in QUIC connection handling in crypto/tls
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.
Products Associated with CVE-2023-39322
Want to know whenever a new CVE is published for GoLang Go? stack.watch will email you.
Affected Versions
Go standard library crypto/tls:- Version 1.21.0-0 and below 1.21.1 is affected.
- Version 1.21.0-0 and below 1.21.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.