CyberSecBulletin

Quic-go Project vulnerabilities

We track 2 vulnerabilities in Quic-go Project products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 4, 2024.

2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score

Latest Quic-go Project vulnerabilities

  • 7.5 High severity

    quic-go: Allocation of Resources Without Limits or Throttling

    CVE-2024-22189Quic-goEPSS 1.11%

    quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to ea

  • 7.5 High severity

    Quic-go: Uncontrolled Resource Consumption

    CVE-2022-30591Quic-go ProjectEPSS 2.92%

    quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs because mtu_discoverer.go misparses the MTU Discovery service and consequent