golang: crypto/tls: panic when processing post-handshake message on QUIC connections

A flaw was found in Golang. Processing an incomplete post-handshake message for a QUIC connection caused a panic...

golang: crypto/tls: lack of a limit on buffered post-handshake

A flaw was found in Golang. QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With the fix, connections now consistently reject messages larger than 65KiB in size...

GHSA-C86P-W88R-QVQR Duplicate Advisory: ring has some AES functions that may panic when overflow checking is enabled in

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4p46-pwfr-66x6. This link is maintained to preserve external references. Original Description A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC...

Duplicate Advisory: ring has some AES functions that may panic when overflow checking is enabled in

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4p46-pwfr-66x6. This link is maintained to preserve external references. Original Description A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC...

DEBIAN-CVE-2025-4432

A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 232 packets sent or received...

CVE-2025-4432

A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 232 packets sent or received...

CVE-2025-4432

A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 232 packets sent or received...

UBUNTU-CVE-2025-4432

A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 232 packets sent or received...

CVE-2025-4432 Ring: some aes functions may panic when overflow checking is enabled in ring

A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 232 packets sent or received...

CVE-2025-4432

CVE-2025-4432 affects Rust’s Ring crate. A panic can be triggered when overflow checking is enabled; in QUIC, a specially crafted packet can induce this panic, likely ~1 in 2^32 packets. CVSS v3.1 base score 5.3 (Network, Low attack complexity, No privileges, No user interaction; Availability imp...

CVE-2025-4432 Ring: some aes functions may panic when overflow checking is enabled in ring

A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 232 packets sent or received...

CVE-2025-4432

A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 232 packets sent or received...

ring 安全漏洞

ring is a library by Brian Smith, a personal developer. A security vulnerability exists in ring, which stems from an overflow check in the QUIC protocol that could trigger a panic, potentially leading to a denial of service attack...

Malicious code in jetty-quic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6783fdd256b0751111ed64602f70d8d479e0bf3dd233363fb9667f7b8567d438 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3630 Malicious code in jetty-quic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6783fdd256b0751111ed64602f70d8d479e0bf3dd233363fb9667f7b8567d438 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Azure Linux 3.0 Security Update: coredns (CVE-2024-53259)

The version of coredns installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53259 advisory. - quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too...

CBL Mariner 2.0 Security Update: coredns (CVE-2024-53259)

The version of coredns installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53259 advisory. - quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too...

Hash Collision Attack

io.netty.incubator, netty-incubator-codec-quic is vulnerable to Hash Collision Attack. The vulnerability is due to a hash collision in the hash map used to manage connections, which allows remote attackers to perform a Hash DoS attack by initiating connections with colliding Source Connection IDs...

CVE-2025-29908

Netty QUIC codec is a QUIC codec for netty which makes use of quiche. An issue was discovered in the codec. A hash collision vulnerability in the hash map used to manage connections allows remote attackers to cause a considerable CPU load on the server a Hash DoS attack by initiating connections...

ch.mobi.mobitor.plugins:mobitor-plugin-bitbucket (>=3.1.305 <=3.1.313), ch.mobi.mobitor.plugins:mobitor-plugin-dwh (>=3.1.305 <=3.1.313) +71 more potentially affected by CVE-2025-29908 via io.netty.incubator:netty-incubator-codec-quic (=0.0.20.Final)

io.netty.incubator:netty-incubator-codec-quic MAVEN version =0.0.20.Final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty.incubator:netty-incubator-codec-quic and may be impacted: - ch.mobi.mobitor.plugins:mobitor-plugin-bitbucket =3.1.305,...