CVE-2023-39322

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Sep 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-393238.1Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to b CVE-2023-393257.5A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While CVE-2023-393265.3A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from th CVE-2023-393274.3A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning me CVE-2023-393285.5A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an app CVE-2023-393296.5A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, cau CVE-2023-39336.1The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and includin CVE-2023-393317.5A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability ari CVE-2023-393329.8Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class ex CVE-2023-393335.3Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data CVE-2023-393359.8A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to imp CVE-2023-393368.8An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the int