CVE-2023-39322

Memory exhaustion in QUIC connection handling in crypto/tls

published September 8, 2023

CVSS
—
EPSS
1%
Percentile
71.2
In the wild
Unconfirmed
What it is

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01345 · 71.2th percentile
Published
2023-09-08T16:13Z
EPSS history
Timeline
  • 08 SEP 16:13Z
    Memory exhaustion in QUIC connection handling in crypto/tls
    cvelistv5