Read the docs
TI-2024-35722 Aliases CVE-2024-53259GHSA-px8v-pp82-rcvr

quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

Priority LOW 30CWE-345Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 4 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-345.

Summary

quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-go attempts to send a packet that exceeds the MTU claimed in that ICMP packet. By setting this value to smaller than 1200 bytes (the minimum MTU for QUIC), the attacker can disrupt a QUIC connection. Crucially, this can be done after completion of the handshake, thereby circumventing any TCP fallback that might be implemented on the application layer (for example, many browsers fall back to HTTP over TCP if they're unable to establish a QUIC connection). The attacker needs to at least know the client's IP and port tuple to mount an attack. This vulnerability is fixed in 0.48.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00604 49th percentileScored 2026-11-07
Fix Partial quic-go (quic-go): 0.48.2github.com/quic-go/quic-go (Go): 0.48.2Red Hat: 5 advisoriesRed Hat: 4 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
quic-goquic-gobefore 0.48.20.48.2Patch availableCNA
—github.com/quic-go/quic-go (Go)before 0.48.20.48.2Patch availableGHSA-px8v-pp82-rcvr
  • quic-go Vendorquic-go Affected before 0.48.2 Fixed in 0.48.2 Patch available CNA
  • github.com/quic-go/quic-go (Go) Vendor— Affected before 0.48.2 Fixed in 0.48.2 Patch available GHSA-px8v-pp82-rcvr

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:*——Quic-go Project
  • cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:* Versions — — ·Quic-go Project

Remediation

  • Fix · CNA quic-go (quic-go) Fixed in 0.48.2
  • Fix · GHSA-px8v-pp82-rcvr github.com/quic-go/quic-go (Go) Fixed in 0.48.2 Advisory →

Red Hat 5 advisories

  • RHSA-2025:4810 Released 2025-05-12 · Red Hat rating Important
    RHSA: Submariner 0.18.5 - bug and security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/lighthouse-agent-rhel9, rhacm2/lighthouse-coredns-rhel9, rhacm2/nettest-rhel9 +6
  • RHSA-2025:4250 Released 2025-04-28 · Red Hat rating Important
    RHSA: Submariner 0.19.4 - bug fix and enhancement update
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/lighthouse-agent-rhel9, rhacm2/lighthouse-coredns-rhel9, rhacm2/nettest-rhel9 +6
  • RHSA-2025:0386 Released 2025-01-16 · Red Hat rating Important
    VolSync 0.10.2 for RHEL 9
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/volsync-operator-bundle, rhacm2/volsync-rhel9
Show 2 more Red Hat advisories
  • RHSA-2025:0385 Released 2025-01-16 · Red Hat rating Important
    VolSync 0.11.1 for RHEL 9
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/volsync-operator-bundle, rhacm2/volsync-rhel9
  • RHSA-2024:10766 Released 2024-12-03 · Red Hat rating Moderate
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.3-1.el8ap, receptor-1.5.1-2.el8ap, receptorctl-1.5.1-2.el8ap
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.3-1.el9ap, receptor-1.5.1-2.el9ap, receptorctl-1.5.1-2.el9ap

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 2AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9Fixed RHSA-2025:0386, RHSA-2025:4810
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9Fixed RHSA-2025:0385, RHSA-2025:4250
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2024:10766
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2024:10766
Not affected: 2 products
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-53259
  2. 2026-10-03 Alias added: GHSA-px8v-pp82-rcvr

References

Advisory 1

Other 5

  • TI-2024-14782 QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack CVSS 3.1HIGH 7.5
  • TI-2023-24866 quic-go vulnerable to pointer dereference that can lead to panic CVSS 3.1HIGH 7.5
  • TI-2026-29554 quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion CVSS 3.1HIGH 7.5
  • TI-2026-17320 webtransport-go CloseWithError can block indefinitely CVSS 3.1HIGH 7.5
  • TI-2026-17319 webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule CVSS 3.1HIGH 7.5
  • TI-2025-37061 quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame CVSS 3.1HIGH 7.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences