CVE-2023-39322 Memory exhaustion in QUIC connection handling in crypto/tls

2023-09-0816:13:32

www.cve.org

cve-2023-39322

quic

memory exhaustion

crypto/tls

unbounded memory growth

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.8%

JSON

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

CNA Affected

[
  {
    "vendor": "Go standard library",
    "product": "crypto/tls",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "crypto/tls",
    "versions": [
      {
        "version": "1.21.0-0",
        "lessThan": "1.21.1",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "QUICConn.HandleData"
      }
    ],
    "defaultStatus": "unaffected"
  }
]