CVE-2023-39321

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Sep 8, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-393227.5QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC coCVE-2023-393238.1Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to bCVE-2023-393257.5A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While CVE-2023-393265.3A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from thCVE-2023-393274.3A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning meCVE-2023-393285.5A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an appCVE-2023-393296.5A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, cauCVE-2023-39336.1The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and includinCVE-2023-393317.5A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability ariCVE-2023-393329.8Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class exCVE-2023-393335.3Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data CVE-2023-393359.8A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to imp
CVE-2023-39321: High severity, CVSS 7.5 | Vulnix