1740 matches found
Linux Distros Unpatched Vulnerability : CVE-2022-30591
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - quic-go through 0.27.0 allows remote attackers to cause a denial of service CPU consumption via a Slowloris variant in which incomplete QUIC or HTTP/3 requests...
Linux Distros Unpatched Vulnerability : CVE-2021-43848
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - h2o is an open source http server. In code prior to the 8c0eca3 commit h2o may attempt to access uninitialized memory. When receiving QUIC frames in certain...
Linux Distros Unpatched Vulnerability : CVE-2024-53259
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used...
Linux Distros Unpatched Vulnerability : CVE-2020-26422
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file CVE-2020-26422 Note that...
Linux Distros Unpatched Vulnerability : CVE-2024-22189
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of...
Linux Distros Unpatched Vulnerability : CVE-2025-29785
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to...
Security update for v2ray-core (important)
openSUSE Security Update: Security update for v2ray-core Announcement ID: openSUSE-SU-2025:0323-1 Rating: important References: 1222488 1235164 1243946 Cross-References: CVE-2024-22189 CVE-2025-297850 CVSS scores: CVE-2024-22189 SUSE: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected...
Security update for v2ray-core (important)
openSUSE Security Update: Security update for v2ray-core Announcement ID: openSUSE-SU-2025:0322-1 Rating: important References: 1222488 1235164 1243946 Cross-References: CVE-2024-22189 CVE-2025-297850 CVSS scores: CVE-2024-22189 SUSE: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected...
SUSE CVE-2025-47950
CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service DoS vulnerability exists in the CoreDNS DNS-over-QUIC DoQ server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of...
Linux Distros Unpatched Vulnerability : CVE-2017-15407
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via a malicious server...
QUIC-LEAK (CVE-2025-54939): New High-Risk Pre-Handshake Remote Denial of Service in LSQUIC QUIC Implementation
Imperva Offensive team discovered that threat actors could smuggle malformed packets to exhaust memory and crash QUIC servers even before a connection handshake is established, therefore, bypassing QUIC connection-level safeguards. Executive Summary QUIC-LEAK CVE-2025-54939 is a newly discovered...
Linux Distros Unpatched Vulnerability : CVE-2025-4432
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induc...
bolic-network (0.0.1), futures-quic (>=0.2.4, <=0.2.8) +7 more potentially affected by CVE-2025-7054 via quiche (>=0.16.0, <=0.22.0)
quiche CARGO version =0.16.0, =0.2.4, =0.0.1, =0.1.0, =0.1.1 Source cves: CVE-2025-7054 Source advisory: OSV:GHSA-M3HH-F9GH-74C2...
CVE-2025-7054
The CVE-2025-7054 entry concerns Cloudflare’s quiche QUIC/TLS library, where an unauthenticated attacker can trigger an infinite loop by sending RETIRE_CONNECTION_ID frames. The issue arises from how retirement across paths can synchronize multiple active connection IDs, allowing a retirement fra...
CVE-2025-7054 Infinite loop triggered by connection ID retirement
Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRECONNECTIONID frames. QUIC connections possess a set of connection identifiers IDs; see Section 5.1 of RFC 9000 https://datatracker.ietf.org/doc/html/rfc9000section-5.1 . Once the QUIC...
CBL Mariner 2.0 Security Update: mysql (CVE-2025-5025)
The version of mysql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-5025 advisory. - libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this...
PT-2025-32266 · Cloudflare · Cloudflare Quiche
Name of the Vulnerable Software and Affected Versions: Cloudflare quiche versions 0.15.0 through 0.24.5 Description: Cloudflare quiche is susceptible to an infinite loop when processing packets containing RETIRE CONNECTION ID frames. QUIC connections utilize connection identifiers IDs with sequen...
CVE-2025-54939
LiteSpeed QUIC LSQUIC Library before 4.3.1 has an lsquicenginepacketin memory leak...
