-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RustRust| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| quiche | rust | < 0.19.2 | 0.19.2 |
| quiche | rust | >= 0.20.0, < 0.20.1 | 0.20.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from missing bounds checking when handling CRYPTO frames. The patch adds a MAX_CRYPTO_STREAM_OFFSET check (1 << 16) in the CRYPTO frame processing logic. The diff shows this check was inserted in the Frame::Crypto handler within Connection implementation in lib.rs. Before the fix, the code would accept any offset value, enabling attackers to exhaust memory by sending overlapping/out-of-order CRYPTO frames with large offsets, forcing the system to buffer unreasonably large amounts of data.
KEV Misses 88% of Exploited CVEs- Get the report