CVE-2023-39322 — Memory exhaustion in QUIC connection handling in crypto/tls
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory gr…
Published: 2023-09-08 · CVSS: Unscored
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7