CVE-2023-46239

Katalog CVE

CVSS 7.5 · High EPSS 0,77%

Kerentanan Uncaught Exception pada quic-go project quic-go. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.

Rincian

Terbit di NVD

31 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-248: Uncaught Exception
CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9h patch · advisory vendor
• https://github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617 patch
• https://github.com/quic-go/quic-go/releases/tag/v0.37.3 release notes