Panic when processing post-handshake message on QUIC connections in crypto/tls
Priority MEDIUM 42CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 18 fixed, 34 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-400.
Summary
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01345 71st percentileScored 2026-11-07
Fix Partial crypto/tls (Go standard library): 1.21.1Red Hat: 25 advisoriesRed Hat: 18 fixed, 34 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | crypto/tls | 1.21.0-0 to before 1.21.1 | 1.21.1 | Patch available | CNA |
- crypto/tls VendorGo standard library Affected 1.21.0-0 to before 1.21.1 Fixed in 1.21.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | 1.21.0 to before 1.21.1 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions 1.21.0 to before 1.21.1 Vulnerable ·Go standard library
Remediation
- Fix · CNA crypto/tls (Go standard library) Fixed in 1.21.1
Red Hat 25 advisories
- RHSA-2025:7256 Released 2025-05-13 · Red Hat rating Moderategit-lfs security update
- Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.6.1-1.el9
- RHSA-2024:3467 Released 2024-05-29 · Red Hat rating ImportantRed Hat OpenStack Platform 16.1 (etcd) security update
- Red Hat OpenStack Platform 16.1 etcd-3.3.23-16.el8ost
- RHSA-2024:3352 Released 2024-05-23 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2 (etcd) security update
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-16.el8ost
Show 22 more Red Hat advisories
- RHSA-2024:2988 Released 2024-05-22 · Red Hat rating Moderatecontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x::container-tools:rhel8 +47
- RHSA-2024:1901 Released 2024-04-18 · Red Hat rating ModerateRed Hat Service Interconnect 1.5.3 Release (images)
- Red Hat Service Interconnect 1 service-interconnect/skupper-config-sync-rhel9, service-interconnect/skupper-controller-podman-rhel9, service-interconnect/skupper-flow-collector-rhel9 +4
- RHSA-2024:1383 Released 2024-03-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.15.0 security, enhancement, & bug fix update
- RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +23
- RHSA-2024:0121 Released 2024-01-10 · Red Hat rating Moderatecontainer-tools:4.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.s390x::container-tools:4.0 +47
- RHSA-2023:7762 Released 2023-12-12 · Red Hat rating Moderateskopeo security update
- Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.13.3-3.el9_3, skopeo-tests-2:1.13.3-3.el9_3
- RHSA-2023:7764 Released 2023-12-12 · Red Hat rating Moderatebuildah security update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.31.3-2.el9_3, buildah-tests-1:1.31.3-2.el9_3
- RHSA-2023:7766 Released 2023-12-12 · Red Hat rating Moderatecontainernetworking-plugins security update
- Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.3.0-6.el9_3
- RHSA-2023:7763 Released 2023-12-12 · Red Hat rating Moderaterunc security update
- Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.1.9-2.el9_3
- RHSA-2023:7765 Released 2023-12-12 · Red Hat rating Moderatepodman security update
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.6.1-7.el9_3, podman-docker-2:4.6.1-7.el9_3, podman-gvproxy-2:4.6.1-7.el9_3 +3
- RHSA-2023:7517 Released 2023-11-27 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor-1.4.3-1.el8ap
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor-1.4.3-1.el9ap
- RHSA-2023:6840 Released 2023-11-15 · Red Hat rating ImportantOpenShift Container Platform 4.14.2 packages and security update
- Red Hat OpenShift Container Platform 4.14 cri-o-1.27.1-13.1.rhaos4.14.git956c5f7.el8, cri-o-1.27.1-13.1.rhaos4.14.git956c5f7.el9, openshift-clients-4.14.0-202311031050.p0.g9b1e0d2.assembly.stream.el8 +3
- RHSA-2023:6154 Released 2023-11-01 · Red Hat rating ImportantSecondary Scheduler Operator for Red Hat OpenShift 1.2.0
- OSSO 1.2 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-bundle, openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2023:5008 Released 2023-10-31 · Red Hat rating ImportantRed Hat build of MicroShift 4.14.0 security update
- Red Hat OpenShift Container Platform 4.14 microshift-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9, microshift-networking-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9, microshift-release-info-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 +1
- RHSA-2023:5009 Released 2023-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.14.0 security update
- Ironic content for Red Hat OpenShift Container Platform 4.14 openstack-ironic-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-api-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-common-1:21.5.0-0.20231002130534.0df5961.el9 +47
- Red Hat OpenShift Container Platform 4.14 afterburn-5.4.3-1.rhaos4.14.el9, afterburn-dracut-5.4.3-1.rhaos4.14.el9, bpftool-7.0.0-284.36.1.el9_2 +47
- RHSA-2023:6202 Released 2023-10-30 · Red Hat rating ImportantRed Hat Advanced Cluster Management 2.6.8 security and bug fix updates
- Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
- RHSA-2023:6200 Released 2023-10-30 · Red Hat rating ImportantMulticluster Engine for Kubernetes 2.1.9 security updates and bug fixes
- multicluster engine for Kubernetes 2.1 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/apiserver-network-proxy-rhel8, multicluster-engine/assisted-image-service-rhel8 +37
- RHSA-2023:6161 Released 2023-10-30 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.7.14 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8, rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8 +3
- RHSA-2023:5947 Released 2023-10-26 · Red Hat rating ImportantRun Once Duration Override Operator for Red Hat OpenShift 1.0.1 security update
- RODOO 1.0 for RHEL 8 run-once-duration-override-operator/run-once-duration-override-rhel8
- RHSA-2023:6115 Released 2023-10-25 · Red Hat rating ImportantOpenShift API for Data Protection security update
- 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-for-aws-rhel8 +6
- RHSA-2023:6085 Released 2023-10-24 · Red Hat rating ImportantRed Hat OpenShift distributed tracing security update
- Red Hat OpenShift distributed tracing 2.9 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +15
- RHSA-2023:6031 Released 2023-10-23 · Red Hat rating ImportantCryostat security update
- Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3
- RHSA-2023:5974 Released 2023-10-20 · Red Hat rating ImportantNetwork Observability security update
- NETOBSERV 1.4 for RHEL 9 network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9 +1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Go standard library crypto/tls 1.21.1
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2023-20464 Memory exhaustion in QUIC connection handling in crypto/tlsPriority MEDIUM 42
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cost Management Metrics Operator | Affected | No fix yet |
| Node HealthCheck Operator | Affected | No fix planned: Will not fix |
| Node Maintenance Operator | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certification for Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat OpenStack Platform 17.0 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Web Terminal | Affected | No fix yet |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Self Node Remediation Operator | Affected | No fix yet |
| Service Telemetry Framework 1.5 | Affected | No fix yet |
| mirror registry for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| 8Base-MTV-2.5 | Fixed | — |
| 8Base-OADP-1.1 | Fixed | RHSA-2023:6115 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2023:6161 |
| Cryostat 2 on RHEL 8 | Fixed | RHSA-2023:6031 |
| LVMS 4.14 for RHEL 9 | Fixed | — |
| NETOBSERV 1.4 for RHEL 9 | Fixed | RHSA-2023:5974 |
| OSSO 1.2 for RHEL 8 | Fixed | RHSA-2023:6154 |
| RHODF 4.15 for RHEL 9 | Fixed | RHSA-2024:1383 |
| RODOO 1.0 for RHEL 8 | Fixed | RHSA-2023:5947 |
| Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | Fixed | RHSA-2023:6202 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2023:7517 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2023:7517 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:0121, RHSA-2024:2988 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:7762, RHSA-2023:7763, RHSA-2023:7764, RHSA-2023:7765, RHSA-2023:7766, RHSA-2025:7256 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2023:5008, RHSA-2023:5009, RHSA-2023:6840 |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2024:3467 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2024:3352 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2024:1901 |
Not affected: 20 products
- 8Base-MTV-2.5
- 8Base-OADP-1.1
- 8Base-RHMTC-1.7
- Cryostat 2 on RHEL 8
- Ironic content for Red Hat OpenShift Container Platform 4.14
- Logging Subsystem for Red Hat OpenShift
- NETOBSERV 1.4 for RHEL 9
- OpenShift Service Mesh 2
- RHODF 4.15 for RHEL 9
- RODOO 1.0 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- cert-manager Operator for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2023-39321
- 2026-10-03 Alias added: GHSA-9v7r-x7cv-v437
- 2026-10-16 Fix available: Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 · Red Hat
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-39321 · CVE Program
- CVE-2023-39321 · NVD
- FIRST EPSS
- GHSA-9v7r-x7cv-v437 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-39321 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences