quic-go vulnerable to pointer dereference that can lead to panic

CAO 7.5CVE-2023-46239 · GHSA-3q6m-v84f-6p9h · GO-2023-2160 · Công bố 31/10/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-46239 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng github.com/quic-go/quic-go, quic-go (quic-go project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.96%, cao hơn 61.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.37.3 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/quic-go/quic-go Go	`≥ 0.37.0, < 0.37.3`	`0.37.3`
quic-go quic-go_project	`≥ 0.37.0, < 0.37.3`	`0.37.3`

Mô tả

quic-go is an implementation of the QUIC transport protocol in Go. By serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space.

Impact

An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets.

Patches

v0.37.3 contains a patch. Versions before v0.37.0 are not affected.

Mô tả của NVD

quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.