1. Home
  2. Security Advisories
  3. Go
  4. GO-2023-2045

[GO-2023-2045] Memory exhaustion in QUIC connection handling in crypto/tls

Severity High
Affected Packages 1
Fixed Packages 1
CVEs 1
Info Packages Vulnerabilities

QUIC connections do not set an upper bound on the amount of data buffered when
reading post-handshake messages, allowing a malicious QUIC connection to cause
unbounded memory growth.

With fix, connections now consistently reject messages larger than 65KiB in
size.

Package Affected Version
pkg:golang/crypto/tls >= 1.21.0, < 1.21.1
Package Fixed Version
pkg:golang/crypto/tls = 1.21.1
ID
GO-2023-2045
Severity
high
Severity from
CVE-2023-39322
URL
https://pkg.go.dev/vuln/GO-2023-2045
Published
2023-09-06T22:17:59
(12 months ago)
Modified
2024-07-17T19:54:18
(2 months ago)
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Fixed pkg:golang/crypto/tls crypto tls = 1.21.1
Affected pkg:golang/crypto/tls crypto tls >= 1.21.0 < 1.21.1
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date