Vulnerability · Published Sep 8, 2023 · Assigned by Go

CVE-2023-39322Memory exhaustion in QUIC connection handling in crypto/tls

High 7.5

In plain English

A high-severity security flaw in crypto/tls from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.3%top 28.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8aardvark-dns2:1.0.1-38.module_el8.9.0+3627+db8ec155ALSA-2024:0121
AlmaLinux:8buildah1:1.24.6-7.module_el8.9.0+3627+db8ec155ALSA-2024:0121
AlmaLinux:9buildah1:1.31.3-2.el9_3ALSA-2023:7764
AlmaLinux:8buildah-tests1:1.24.6-7.module_el8.9.0+3687+dcd7ef8fALSA-2024:0121
AlmaLinux:8buildah-tests1:1.24.6-7.module_el8.9.0+3627+db8ec155ALSA-2024:0121
AlmaLinux:9buildah-tests1:1.31.3-2.el9_3ALSA-2023:7764
AlmaLinux:8cockpit-podman46-1.module_el8.7.0+3344+5bcd850fALSA-2024:0121
AlmaLinux:8conmon2:2.1.4-2.module_el8.9.0+3687+dcd7ef8fALSA-2024:0121
AlmaLinux:8conmon2:2.1.4-2.module_el8.9.0+3627+db8ec155ALSA-2024:0121
AlmaLinux:8container-selinux2:2.205.0-3.module_el8.9.0+3627+db8ec155ALSA-2024:0121
AlmaLinux:8containernetworking-plugins1:1.1.1-6.module_el8.9.0+3711+04fcca5eALSA-2024:0121
AlmaLinux:9containernetworking-plugins1:1.3.0-6.el9_3ALSA-2023:7766
AlmaLinux:8containers-common2:1-38.module_el8.9.0+3627+db8ec155ALSA-2024:0121
AlmaLinux:8crit3.15-3.module_el8.6.0+3137+d33c3efbALSA-2024:0121
AlmaLinux:8crit3.15-3.module_el8.6.0+2877+8e437bf5ALSA-2024:0121
AlmaLinux:8criu3.15-3.module_el8.6.0+3137+d33c3efbALSA-2024:0121
AlmaLinux:8criu3.15-3.module_el8.6.0+2877+8e437bf5ALSA-2024:0121
AlmaLinux:8criu-devel3.15-3.module_el8.6.0+3137+d33c3efbALSA-2024:0121
AlmaLinux:8criu-devel3.15-3.module_el8.6.0+2877+8e437bf5ALSA-2024:0121
AlmaLinux:8criu-libs3.15-3.module_el8.6.0+2877+8e437bf5ALSA-2024:0121
AlmaLinux:8criu-libs3.15-3.module_el8.6.0+3137+d33c3efbALSA-2024:0121
AlmaLinux:8crun1.8.7-1.module_el8.9.0+3683+33eb0febALSA-2024:0121
AlmaLinux:8fuse-overlayfs1.9-2.module_el8.9.0+3627+db8ec155ALSA-2024:0121
AlmaLinux:9git-lfs3.6.1-1.el9ALSA-2025:7256
AlmaLinux:8libslirp4.4.0-1.module_el8.6.0+2877+8e437bf5ALSA-2024:0121
AlmaLinux:8libslirp4.4.0-1.module_el8.6.0+3137+d33c3efbALSA-2024:0121
AlmaLinux:8libslirp-devel4.4.0-1.module_el8.6.0+3137+d33c3efbALSA-2024:0121
AlmaLinux:8libslirp-devel4.4.0-1.module_el8.6.0+2877+8e437bf5ALSA-2024:0121
AlmaLinux:8netavark2:1.0.1-38.module_el8.9.0+3627+db8ec155ALSA-2024:0121
AlmaLinux:8oci-seccomp-bpf-hook1.2.5-2.module_el8.8.0+3468+16b86c82ALSA-2024:0121
AlmaLinux:8podman2:4.0.2-25.module_el8.9.0+3711+04fcca5e.alma.1ALSA-2024:0121
AlmaLinux:9podman2:4.6.1-7.el9_3ALSA-2023:7765
AlmaLinux:8podman-catatonit2:4.0.2-25.module_el8.9.0+3711+04fcca5e.alma.1ALSA-2024:0121
AlmaLinux:8podman-docker2:4.0.2-25.module_el8.9.0+3711+04fcca5e.alma.1ALSA-2024:0121
AlmaLinux:9podman-docker2:4.6.1-7.el9_3ALSA-2023:7765
AlmaLinux:8podman-gvproxy2:4.0.2-25.module_el8.9.0+3711+04fcca5e.alma.1ALSA-2024:0121
AlmaLinux:9podman-gvproxy2:4.6.1-7.el9_3ALSA-2023:7765
AlmaLinux:8podman-plugins2:4.0.2-25.module_el8.9.0+3711+04fcca5e.alma.1ALSA-2024:0121
AlmaLinux:9podman-plugins2:4.6.1-7.el9_3ALSA-2023:7765
AlmaLinux:8podman-remote2:4.0.2-25.module_el8.9.0+3711+04fcca5e.alma.1ALSA-2024:0121
AlmaLinux:9podman-remote2:4.6.1-7.el9_3ALSA-2023:7765
AlmaLinux:8podman-tests2:4.0.2-25.module_el8.9.0+3711+04fcca5e.alma.1ALSA-2024:0121
AlmaLinux:9podman-tests2:4.6.1-7.el9_3ALSA-2023:7765
AlmaLinux:8python3-criu3.15-3.module_el8.6.0+2877+8e437bf5ALSA-2024:0121
AlmaLinux:8python3-criu3.15-3.module_el8.6.0+3137+d33c3efbALSA-2024:0121
AlmaLinux:8python3-podman4.0.0-2.module_el8.9.0+3627+db8ec155ALSA-2024:0121
AlmaLinux:8python3-podman4.0.0-2.module_el8.9.0+3711+04fcca5eALSA-2024:0121
AlmaLinux:8runc1:1.1.5-2.module_el8.9.0+3687+dcd7ef8fALSA-2024:0121
AlmaLinux:8runc1:1.1.5-2.module_el8.9.0+3627+db8ec155ALSA-2024:0121
AlmaLinux:9runc4:1.1.9-2.el9_3ALSA-2023:7763
AlmaLinux:8skopeo2:1.6.2-9.module_el8.9.0+3687+dcd7ef8f.alma.1ALSA-2024:0121
AlmaLinux:9skopeo2:1.13.3-3.el9_3ALSA-2023:7762
AlmaLinux:8skopeo-tests2:1.6.2-9.module_el8.9.0+3687+dcd7ef8f.alma.1ALSA-2024:0121
AlmaLinux:9skopeo-tests2:1.13.3-3.el9_3ALSA-2023:7762
AlmaLinux:8slirp4netns1.1.8-3.module_el8.9.0+3627+db8ec155ALSA-2024:0121
AlmaLinux:8toolbox0.0.99.4-5.module_el8.9.0+3627+db8ec155ALSA-2024:0121
AlmaLinux:8toolbox-tests0.0.99.4-5.module_el8.9.0+3627+db8ec155ALSA-2024:0121
AlmaLinux:8udica0.2.6-4.module_el8.9.0+3627+db8ec155ALSA-2024:0121
Alpine:v3.20go1.21.1-r0ALPINE-CVE-2023-39322
Alpine:v3.21go1.21.1-r0ALPINE-CVE-2023-39322
Alpine:v3.22go1.21.1-r0ALPINE-CVE-2023-39322
Alpine:v3.23go1.21.1-r0ALPINE-CVE-2023-39322
Alpine:v3.24go1.21.1-r0ALPINE-CVE-2023-39322
Gostdlib1.21.1GO-2023-2045
Rocky Linux:8aardvark-dns2:1.10.0-1.module+el8.10.0+1815+5fe7415eRLSA-2024:2988
Rocky Linux:8aardvark-dns2:1.10.0-1.module+el8.10.0+1825+623b0c20RLSA-2024:2988
Rocky Linux:8aardvark-dns2:1.10.0-1.module+el8.10.0+1843+6892ab28RLSA-2024:2988
Rocky Linux:8aardvark-dns2:1.10.0-1.module+el8.10.0+1872+2e18eb19RLSA-2024:2988
Rocky Linux:8buildah1:1.24.6-7.module+el8.9.0+1445+07728297RLSA-2024:0121
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1874+ce489889RLSA-2024:2988
Rocky Linux:8cockpit-podman0:46-1.module+el8.9.0+1445+07728297RLSA-2024:0121
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1815+5fe7415eRLSA-2024:2988
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1825+623b0c20RLSA-2024:2988
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1843+6892ab28RLSA-2024:2988
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1872+2e18eb19RLSA-2024:2988
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1880+8e896d1bRLSA-2024:2988
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1896+b18fa106RLSA-2024:2988
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1948+4b5cd4a9RLSA-2024:2988
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1843+6892ab28RLSA-2024:2988
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1872+2e18eb19RLSA-2024:2988
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1874+ce489889RLSA-2024:2988
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1880+8e896d1bRLSA-2024:2988
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1948+4b5cd4a9RLSA-2024:2988
Rocky Linux:8conmon2:2.1.4-2.module+el8.9.0+1445+07728297RLSA-2024:0121
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1896+b18fa106RLSA-2024:2988
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1815+5fe7415eRLSA-2024:2988
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1815+5fe7415eRLSA-2024:2988
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1874+ce489889RLSA-2024:2988
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1843+6892ab28RLSA-2024:2988
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1872+2e18eb19RLSA-2024:2988
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1880+8e896d1bRLSA-2024:2988
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1896+b18fa106RLSA-2024:2988
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1948+4b5cd4a9RLSA-2024:2988
Rocky Linux:8container-selinux2:2.205.0-3.module+el8.9.0+1445+07728297RLSA-2024:0121
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1825+623b0c20RLSA-2024:2988
Rocky Linux:8containernetworking-plugins1:1.4.0-2.module+el8.10.0+1815+5fe7415eRLSA-2024:2988
Rocky Linux:8containernetworking-plugins1:1.4.0-2.module+el8.10.0+1825+623b0c20RLSA-2024:2988
Rocky Linux:8containers-common2:1-81.module+el8.10.0+1825+623b0c20RLSA-2024:2988
Rocky Linux:8containers-common2:1-38.module+el8.9.0+1445+07728297RLSA-2024:0121
Rocky Linux:8containers-common2:1-81.module+el8.10.0+1815+5fe7415eRLSA-2024:2988
Rocky Linux:8criu0:3.15-3.module+el8.9.0+1445+07728297RLSA-2024:0121
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1896+b18fa106RLSA-2024:2988
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1825+623b0c20RLSA-2024:2988
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1843+6892ab28RLSA-2024:2988
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1872+2e18eb19RLSA-2024:2988
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1815+5fe7415eRLSA-2024:2988
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1874+ce489889RLSA-2024:2988
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1880+8e896d1bRLSA-2024:2988
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1948+4b5cd4a9RLSA-2024:2988
Rocky Linux:8fuse-overlayfs0:1.9-2.module+el8.9.0+1445+07728297RLSA-2024:0121
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1815+5fe7415eRLSA-2024:2988
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1825+623b0c20RLSA-2024:2988
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1843+6892ab28RLSA-2024:2988
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1872+2e18eb19RLSA-2024:2988
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1874+ce489889RLSA-2024:2988
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1880+8e896d1bRLSA-2024:2988
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1896+b18fa106RLSA-2024:2988
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1948+4b5cd4a9RLSA-2024:2988
Rocky Linux:9git-lfs0:3.6.1-1.el9RLSA-2025:7256
Rocky Linux:8libslirp0:4.4.0-1.module+el8.9.0+1445+07728297RLSA-2024:2988
Rocky Linux:8libslirp0:4.4.0-1.module+el8.9.0+1445+07728297RLSA-2024:0121
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1843+6892ab28RLSA-2024:2988
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1872+2e18eb19RLSA-2024:2988
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1874+ce489889RLSA-2024:2988
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1880+8e896d1bRLSA-2024:2988
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1896+b18fa106RLSA-2024:2988
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1948+4b5cd4a9RLSA-2024:2988
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1815+5fe7415eRLSA-2024:2988
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1825+623b0c20RLSA-2024:2988
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1880+8e896d1bRLSA-2024:2988
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1815+5fe7415eRLSA-2024:2988
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1825+623b0c20RLSA-2024:2988
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1843+6892ab28RLSA-2024:2988
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1872+2e18eb19RLSA-2024:2988
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1874+ce489889RLSA-2024:2988
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1896+b18fa106RLSA-2024:2988
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1948+4b5cd4a9RLSA-2024:2988
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.5-2.module+el8.9.0+1445+07728297RLSA-2024:0121
Rocky Linux:8python-podman0:4.0.0-2.module+el8.9.0+1445+07728297RLSA-2024:0121
Rocky Linux:8python-podman0:4.9.0-1.module+el8.10.0+1815+5fe7415eRLSA-2024:2988
Rocky Linux:8python-podman0:4.9.0-1.module+el8.10.0+1825+623b0c20RLSA-2024:2988
Rocky Linux:8runc1:1.1.12-1.module+el8.10.0+1815+5fe7415eRLSA-2024:2988
Rocky Linux:8runc1:1.1.12-1.module+el8.10.0+1825+623b0c20RLSA-2024:2988
Rocky Linux:8runc1:1.1.5-2.module+el8.9.0+1445+07728297RLSA-2024:0121
Rocky Linux:8skopeo2:1.6.2-9.module+el8.9.0+1578+aa900b44RLSA-2024:0121
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1880+8e896d1bRLSA-2024:2988
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1896+b18fa106RLSA-2024:2988
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1948+4b5cd4a9RLSA-2024:2988
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1874+ce489889RLSA-2024:2988
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1843+6892ab28RLSA-2024:2988
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1815+5fe7415eRLSA-2024:2988
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1825+623b0c20RLSA-2024:2988
Rocky Linux:8slirp4netns0:1.1.8-3.module+el8.9.0+1445+07728297RLSA-2024:0121
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1872+2e18eb19RLSA-2024:2988
Rocky Linux:8toolbox0:0.0.99.5-2.module+el8.10.0+1880+8e896d1b.rocky.0.2RLSA-2024:2988
Rocky Linux:8toolbox0:0.0.99.5-2.module+el8.10.0+1896+b18fa106.rocky.0.2RLSA-2024:2988
Rocky Linux:8toolbox0:0.0.99.5-2.module+el8.10.0+1948+4b5cd4a9.rocky.0.2RLSA-2024:2988
Rocky Linux:8toolbox0:0.0.99.5-2.module+el8.10.0+1843+6892ab28.rocky.0.2RLSA-2024:2988
Rocky Linux:8toolbox0:0.0.99.5-2.module+el8.10.0+1872+2e18eb19.rocky.0.2RLSA-2024:2988
Rocky Linux:8toolbox0:0.0.99.5-2.module+el8.10.0+1874+ce489889.rocky.0.2RLSA-2024:2988
Rocky Linux:8toolbox0:0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2RLSA-2024:2988
Rocky Linux:8toolbox0:0.0.99.5-2.module+el8.10.0+1825+623b0c20.rocky.0.2RLSA-2024:2988
Rocky Linux:8toolbox0:0.0.99.5-2.module+el8.10.0+1829+9bb2696f.rocky.0.2RLSA-2024:2988
Rocky Linux:8udica0:0.2.6-4.module+el8.9.0+1445+07728297RLSA-2024:0121
Ubuntu:22.04:LTSgolang-1.211.21.1-1~ubuntu22.04.1UBUNTU-CVE-2023-39322
Ubuntu:24.04:LTSgolang-1.211.21.5-1UBUNTU-CVE-2023-39322

Affected products (as reported)

VendorProductVersions
Go standard library crypto/tls 1.21.0-0 – before 1.21.1

References