Lucene search
GitHub Advisory DatabaseGHSA-FR44-546P-7XCPHistoryOct 10, 2023 - 10:23 p.m.
MsQuic Remote Denial of Service Vulnerability
2023-10-1022:23:28
CWE-400
CWE-401
GitHub Advisory Database
github.com
19
msquic
server
memory leak
denial of service
vulnerability
patch
workaround
software
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
27.6%
Impact
The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.
Patches
The following patch was made:
- Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb
Workarounds
Beyond upgrading to the patched versions, there is no other workaround.
Affected configurations
Node
microsoft.native.quic.msquic.schannelRange<2.2.3
ORmicrosoft.native.quic.msquic.opensslRange<2.2.3
| CPE | Name | Operator | Version |
|---|---|---|---|
| microsoft.native.quic.msquic.schannel | lt | 2.2.3 | |
| microsoft.native.quic.msquic.openssl | lt | 2.2.3 |
Related
nvd
nvd
CVE-2023-36435
2023-10-10 18:15:12
prion
prion
Denial of service
2023-10-10 18:15:00
cvelist
cvelist
CVE-2023-36435 Microsoft QUIC Denial of Service Vulnerability
2023-10-10 17:08:03
osv
osv
MsQuic Remote Denial of Service Vulnerability
2023-10-10 22:23:28
BIT-dotnet-2023-36435
2024-03-06 10:54:00
BIT-dotnet-sdk-2023-36435
2024-03-06 10:54:02
redhatcve
redhatcve
CVE-2023-36435
2023-10-10 21:12:30
cve
cve
CVE-2023-36435
2023-10-10 18:15:12
alpinelinux
alpinelinux
CVE-2023-36435
2023-10-10 18:15:12
veracode
veracode
Denial Of Service (DoS)
2023-10-16 08:15:52
cnvd
cnvd
Microsoft QUIC Denial of Service Vulnerability
2023-10-13 00:00:00
mscve
mscve
Microsoft QUIC Denial of Service Vulnerability
2023-10-10 07:00:00
openvas
openvas
.NET Core Multiple DoS Vulnerabilities - Windows
2023-10-11 00:00:00
Microsoft Windows Multiple Vulnerabilities (KB5031354)
2023-10-11 00:00:00
Microsoft Windows Multiple Vulnerabilities (KB5031358)
2023-10-11 00:00:00
nessus
nessus
Security Update for Microsoft .NET 7 Core (October 2023)
2023-10-13 00:00:00
Security Update for .NET Core SDK (October 2023)
2023-10-11 00:00:00
KB5031358: Windows 11 version 21H2 Security Update (October 2023)
2023-10-10 00:00:00
mskb
mskb
.NET 7.0 Update - October 10, 2023 (KB5031901)
2023-10-10 07:00:00
October 10, 2023âKB5031354 (OS Build 22621.2428)
2023-10-10 07:00:00
October 10, 2023âKB5031358 (OS Build 22000.2538)
2023-10-10 07:00:00
kaspersky
kaspersky
KLA61353 Multiple vulnerabilities in Microsoft Developer Tools
2023-10-10 00:00:00
KLA61358 Multiple vulnerabilities in Microsoft Windows
2023-10-10 00:00:00
ics
ics
Siemens ST7 ScadaConnect
2024-06-13 12:00:00
rapid7blog
rapid7blog
Patch Tuesday - October 2023
2023-10-10 20:34:57
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
27.6%
Related for GHSA-FR44-546P-7XCP