CVE-2023-39322: falha em Go standard library crypto/tls
Memory exhaustion in QUIC connection handling in crypto/tls
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 1.3%
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.
Produtos afetados
Go standard library · crypto/tlsCVEs relacionadas — Go standard library crypto/tls
No mesmo produto, das mais perigosas para as menos.
CVE-2023-29409—Large RSA keys can cause high CPU usage in crypto/tlsEPSS 1.6%CVE-2023-39321—Panic when processing post-handshake message on QUIC connections in crypto/tlsEPSS 1.3%CVE-2023-45287—Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channelEPSS 1.3%CVE-2022-30629LOWSession tickets lack random ticket_age_add in crypto/tlsEPSS 1.2%CVE-2022-41724—Panic on large handshake records in crypto/tlsEPSS 1.1%CVE-2025-68121CRITICALUnexpected session resumption in crypto/tlsEPSS 0.9%