CVE-2024-22189

quic-go is an implementation of the QUIC protocol in Go. Prior to version
0.42.0, an attacker can cause its peer to run out of memory sending a large
number of NEW_CONNECTION_ID frames that retire old connection IDs. The
receiver is supposed to respond to each retirement frame with a
RETIRE_CONNECTION_ID frame. The attacker can prevent the receiver from
sending out (the vast majority of) these RETIRE_CONNECTION_ID frames by
collapsing the peers congestion window (by selectively acknowledging
received packets) and by manipulating the peer’s RTT estimate. Version
0.42.0 contains a patch for the issue. No known workarounds are available.