Vulnerability · Published Jul 6, 2022 · Assigned by mitre
CVE-2022-30591
High 7.5
In plain English
A high-severity security flaw in the golang-github-lucas-clemente-quic-go package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs because mtu_discoverer.go misparses the MTU Discovery service and consequently overflows the probe timer. NOTE: the vendor's position is that this behavior should not be listed as a vulnerability on the CVE List
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-lucas-clemente-quic-go | no fix listed | DEBIAN-CVE-2022-30591 |
| Debian:13 | golang-github-lucas-clemente-quic-go | no fix listed | DEBIAN-CVE-2022-30591 |
| Debian:14 | golang-github-lucas-clemente-quic-go | no fix listed | DEBIAN-CVE-2022-30591 |