https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 10:08:46 +0000 https://vulnerability.circl.lu/vuln/cve-2023-49295 <p><strong>Affected:</strong> quic-go</p> <p>quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer&#39;s RTT estimate. This vulnerability has been patched in versions 0.37.7, 0.38.2 and 0.39.4.</p> <p><strong>Affected:</strong> quic-go</p> <p>quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer&#39;s RTT estimate. This vulnerability has been patched in versions 0.37.7, 0.38.2 and 0.39.4.</p> https://vulnerability.circl.lu/vuln/cve-2023-49295