Quic-go vulnerabilities

2 known vulnerabilities in Quic-go from Quic-go Project. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  quic-go: Allocation of Resources Without Limits or Throttling

  CVE-2024-22189Apr 4, 2024Quic-goEPSS 1.11%

  quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to ea

• 7.5 High severity

  Quic-go: Uncontrolled Resource Consumption

  CVE-2022-30591Jul 6, 2022Quic-go ProjectEPSS 2.92%

  quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs because mtu_discoverer.go misparses the MTU Discovery service and consequent