CVE-2023-46239 - CVE House

Back to Database

Status published High CVE-2023-46239

quic-go vulnerable to pointer dereference that can lead to panic

7.5 CVSS

Vulnerability Description

quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-46239

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from quic-go

View All →

quic-go HTTP/3 QPACK Header Expansion DoS

quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame

quic-go Has Panic in Path Probe Loss Recovery Handling

quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

Affected Vendor

quic-go

View all reports →

Affected Software

quic-go

Vulnerable Versions:

>= 0.37.0, < 0.37.3

Timeline

Official Publish: October 31st, 2023

Last Modified: September 5th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1203 Exploitation for Client Execution

T1213 Data from Information Repositories

T1499.003 Application Exhaustion Flood