CVE-2023-49295CWE-400

quic-go's path validation mechanism can cause denial of service

Medium · published January 10, 2024

CVSS v3.1
6.4
EPSS
1%
Percentile
68.0
In the wild
Unconfirmed
What it is

quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. This vulnerability has been patched in versions 0.37.7, 0.38.2 and 0.39.4.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.01204 · 68.0th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2024-01-10T21:40Z
EPSS history
Timeline
  • 10 JAN 21:40Z
    quic-go's path validation mechanism can cause denial of service
    cvelistv5