CVE-2023-39322

Memory exhaustion in QUIC connection handling in crypto/tls

Summary

Original description

The description as published by the source.

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"1.21.0"},{"fixed":"1.21.1"}]}]

References

advisory security.gentoo.org
advisory security.netapp.com
advisory nvd.nist.gov
advisory github.com
web go.dev
web go.dev
web groups.google.com
web pkg.go.dev
web pkg.go.dev