CVE-2023-46239
quic-go vulnerable to pointer dereference that can lead to panic
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
quic-go vulnerable to pointer dereference that can lead to panic
| Assigner | GitHub_M |
| Reserved | 2023-10-19 |
| Published | 2023-10-31 |
| Updated | 2024-09-05 |
quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.
| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
https://github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9h
https://github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617
https://github.com/quic-go/quic-go/releases/tag/v0.37.3
