CVE-2023-39322 — Allocation of Resources Without Limits or Throttling in Standard Library Crypto TLS

CWE-770 — Allocation of Resources Without Limits or ThrottlingCWE-400 — Uncontrolled Resource Consumption6 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.0%
top 87.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GO Standard Library Crypto TLSGolang GO
Timeline
PublishedSep 8

Description

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDgolang/go1.21.0 — 1.21.1
▶CVEListV5go_standard_library/crypto_tls1.21.0-0 — 1.21.1

Patches

Patch: go.dev ↗Patch: go.dev ↗

🔴Vulnerability Details

4
OSV
CVE-2023-39322: QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection t↗2023-09-08
▶
GHSA
GHSA-892h-r6cr-53g4: QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection t↗2023-09-08
▶
CVEList
Memory exhaustion in QUIC connection handling in crypto/tls↗2023-09-08
▶
OSV
Memory exhaustion in QUIC connection handling in crypto/tls↗2023-09-07
▶

📋Vendor Advisories

1
Red Hat
golang: crypto/tls: lack of a limit on buffered post-handshake↗2023-09-06
▶
CVE-2023-39322 — HIGH severity | cvebase