Launch Week Day 1: Announcing Security Design Review
UNKNOWN Go

Memory exhaustion in QUIC connection handling in crypto/tls

GO-2023-2045 · BIT-golang-2023-39322 · CVE-2023-39322

Published · Modified

Description

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth.

With fix, connections now consistently reject messages larger than 65KiB in size.

Ready to move

Start Securing

Free, no credit card | First findings in minutes