CVE-2023-39322 Memory exhaustion in QUIC connection handling in crypto/tls

2023-09-0816:13:32

github.com

cve-2023-39322

memory exhaustion

quic connection

crypto/tls

fix

unbounded memory growth

65kib

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:go_standard_library:crypto_tls:*:*:*:*:*:*:*:*"
    ],
    "vendor": "go_standard_library",
    "product": "crypto_tls",
    "versions": [
      {
        "status": "affected",
        "version": "1.21.0-0",
        "lessThan": "1.21.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]