CVE-2023-39322

Katalog CVE

CVSS 7.5 · High EPSS 1,3%

Kerentanan Allocation of Resources Without Limits or Throttling pada golang go. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

Rincian

Terbit di NVD

8 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 70,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pkg.go.dev/vuln/GO-2023-2045 advisory vendor
• https://go.dev/cl/523039 patch
• https://security.netapp.com/advisory/ntap-20231020-0004/ advisory pihak ketiga
• https://go.dev/issue/62266 issue tracking
• https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ mailing list · release notes
• https://security.gentoo.org/glsa/202311-09