CVE-2023-46239

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248 CWE-476

Affected software

Vendor	Product	Versions
quic-go	quic-go	>= 0.37.0, < 0.37.3

References

https://github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617Patch
https://github.com/quic-go/quic-go/releases/tag/v0.37.3Release Notes
https://github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9hPatch, Vendor Advisory
https://github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617Patch
https://github.com/quic-go/quic-go/releases/tag/v0.37.3Release Notes
https://github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9hPatch, Vendor Advisory

Timeline

Published: Oct 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-46242.4Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.CVE-2023-462407.5CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report CVE-2023-462418.1`discourse-microsoft-auth` is a plugin that enables authentication via Microsoft. On sites with the `discourse-microsoft-auth` plugin enable CVE-2023-462428.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2023-462438.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2023-462448.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2023-462457.2Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI)CVE-2023-462465.5Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the CVE-2023-462477.5Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate th CVE-2023-462488.8Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remo CVE-2023-462499.8authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is CVE-2023-46255.3Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modul