Read the docs
TI-2024-14782 Aliases CVE-2024-22189GHSA-c33x-xqrf-c478

QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

Priority MEDIUM 41CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01109 66th percentileScored 2026-11-07
Fix Partial quic-go (quic-go): 0.42.0github.com/quic-go/quic-go (Go): 0.42.0Red Hat: 5 advisoriesRed Hat: 7 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
quic-goquic-gobefore 0.42.00.42.0Patch availableCNA
—github.com/quic-go/quic-go (Go)before 0.42.00.42.0Patch availableGHSA-c33x-xqrf-c478
  • quic-go Vendorquic-go Affected before 0.42.0 Fixed in 0.42.0 Patch available CNA
  • github.com/quic-go/quic-go (Go) Vendor— Affected before 0.42.0 Fixed in 0.42.0 Patch available GHSA-c33x-xqrf-c478

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:*——Quic-go Project
  • cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:* Versions — — ·Quic-go Project

Remediation

  • Fix · CNA quic-go (quic-go) Fixed in 0.42.0
  • Fix · GHSA-c33x-xqrf-c478 github.com/quic-go/quic-go (Go) Fixed in 0.42.0 Advisory →

Red Hat 5 advisories

  • RHSA-2025:15847 Released 2025-09-15 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.23.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/machineexec-rhel9 +3
  • RHSA-2024:8534 Released 2024-10-28 · Red Hat rating Moderate
    Red Hat Ansible Automation Platform 2.5 Product Release Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.2-1.el8ap, automation-gateway-server-2.5.3-1.el8ap, receptor-1.4.9-2.el8ap +1
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.2-1.el9ap, automation-gateway-server-2.5.3-1.el9ap, receptor-1.4.9-2.el9ap +1
  • RHSA-2024:5094 Released 2024-08-07 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh Containers for 2.6.0 security update
    • RHOSSM 2.6 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +6
    • RHOSSM 2.6 for RHEL 9 openshift-service-mesh/proxyv2-rhel9
Show 2 more Red Hat advisories
  • RHSA-2024:0041 Released 2024-06-27 · Red Hat rating Critical
    OpenShift Container Platform 4.16.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2024:4144 Released 2024-06-26 · Red Hat rating Moderate
    VolSync 0.9.2 for RHEL 9
    • Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 rhacm2/volsync-operator-bundle, rhacm2/volsync-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
RHOSSM 2.6 for RHEL 8Fixed RHSA-2024:5094
RHOSSM 2.6 for RHEL 9Fixed RHSA-2024:5094
Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9Fixed RHSA-2024:4144
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2024:8534
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2024:8534
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:0041
Red Hat OpenShift Dev Spaces (RHOSDS) 3.23Fixed RHSA-2025:15847
Not affected: 4 products
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22189
  2. 2026-10-03 Alias added: GHSA-c33x-xqrf-c478
  3. 2026-10-13 Affected versions changed · Red Hat

References

Advisory 1

Other 5

  • TI-2023-24866 quic-go vulnerable to pointer dereference that can lead to panic CVSS 3.1HIGH 7.5
  • TI-2026-29554 quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion CVSS 3.1HIGH 7.5
  • TI-2026-17320 webtransport-go CloseWithError can block indefinitely CVSS 3.1HIGH 7.5
  • TI-2026-17319 webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule CVSS 3.1HIGH 7.5
  • TI-2025-37061 quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame CVSS 3.1HIGH 7.5
  • TI-2025-21196 quic-go Has Panic in Path Probe Loss Recovery Handling CVSS 3.1HIGH 7.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences