Read the docs
TI-2023-24866 Aliases CVE-2023-46239GHSA-3q6m-v84f-6p9h

quic-go vulnerable to pointer dereference that can lead to panic

Priority MEDIUM 41CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-248.

Summary

quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00956 61st percentileScored 2026-11-07
Fix Fixed quic-go (quic-go): 0.37.3github.com/quic-go/quic-go (Go): 0.37.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
quic-goquic-go0.37.0 to before 0.37.30.37.3Patch availableCNA
—github.com/quic-go/quic-go (Go)0.37.0 to before 0.37.30.37.3Patch availableGHSA-3q6m-v84f-6p9h
  • quic-go Vendorquic-go Affected 0.37.0 to before 0.37.3 Fixed in 0.37.3 Patch available CNA
  • github.com/quic-go/quic-go (Go) Vendor— Affected 0.37.0 to before 0.37.3 Fixed in 0.37.3 Patch available GHSA-3q6m-v84f-6p9h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:*0.37.0 to before 0.37.3VulnerableQuic-go Project
  • cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:* Versions 0.37.0 to before 0.37.3 Vulnerable ·Quic-go Project

Remediation

  • Fix · CNA quic-go (quic-go) Fixed in 0.37.3
  • Fix · GHSA-3q6m-v84f-6p9h github.com/quic-go/quic-go (Go) Fixed in 0.37.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46239
  2. 2026-10-03 Alias added: GHSA-3q6m-v84f-6p9h

References

Patch 2

Advisory 1

Other 2

  • TI-2024-14782 QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack CVSS 3.1HIGH 7.5
  • TI-2026-29554 quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion CVSS 3.1HIGH 7.5
  • TI-2026-17320 webtransport-go CloseWithError can block indefinitely CVSS 3.1HIGH 7.5
  • TI-2026-17319 webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule CVSS 3.1HIGH 7.5
  • TI-2025-37061 quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame CVSS 3.1HIGH 7.5
  • TI-2025-21196 quic-go Has Panic in Path Probe Loss Recovery Handling CVSS 3.1HIGH 7.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences