UNKNOWN Go
Memory exhaustion in QUIC connection handling in crypto/tls
GO-2023-2045 · BIT-golang-2023-39322 · CVE-2023-39322
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth.
With fix, connections now consistently reject messages larger than 65KiB in size.
Ready to move
Start Securing
Free, no credit card | First findings in minutes