-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from uncontrolled queuing of PATH_RESPONSE frames. The commit diff shows the vulnerable QueueControlFrame function previously appended all PATH_RESPONSE frames to an unbounded slice (controlFrames). Attackers could exploit this by sending excessive PATH_CHALLENGE frames while manipulating congestion control, causing PATH_RESPONSE accumulation. The patch introduces a dedicated pathResponses slice with a 256-item limit in QueueControlFrame, confirming this was the vulnerable function.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/quic-go/quic-go | go | = 0.40.0 | 0.40.1 |
| github.com/quic-go/quic-go | go | >= 0.39.0, < 0.39.4 | 0.39.4 |
| github.com/quic-go/quic-go | go | >= 0.38.0, < 0.38.2 | 0.38.2 |
| github.com/quic-go/quic-go | go | < 0.37.7 | 0.37.7 |