HIGH7.5
GO-2023-2045
Memory exhaustion in QUIC connection handling in crypto/tls
Quick fix
GO-2023-2045 — stdlib: upgrade to the fixed version with the command below.
go get stdlib@v1.21.1Details
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth.
With fix, connections now consistently reject messages larger than 65KiB in size.
Are you affected?
Enter the version of the package you're using.