-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper memory management of retired Connection IDs (CIDs). The unpatched QuicConnRetireCid() function did not enforce a limit on retired CIDs (no RetiredDestCidCount tracking), allowing attackers to exhaust memory. The unpatched QuicLossDetectionOnPacketAcknowledged() function failed to decrement the retired CID counter when freeing memory, preventing proper cleanup. The patch adds RetiredDestCidCount tracking/limits in QuicConnRetireCid and counter decrements in QuicLossDetectionOnPacketAcknowledged, directly addressing the memory leak mechanism described in CWE-401.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.Native.Quic.MsQuic.OpenSSL | nuget | < 2.1.12 | 2.1.12 |
| Microsoft.Native.Quic.MsQuic.Schannel | nuget | >= 2.2.0, < 2.2.7 | 2.2.7 |
| Microsoft.Native.Quic.MsQuic.Schannel | nuget | >= 2.3.0, < 2.3.5 | 2.3.5 |
| Microsoft.Native.Quic.MsQuic.Schannel | nuget | < 2.1.12 | 2.1.12 |
| Microsoft.Native.Quic.MsQuic.OpenSSL | nuget | >= 2.2.0, < 2.2.7 | 2.2.7 |
| Microsoft.Native.Quic.MsQuic.OpenSSL | nuget | >= 2.3.0, < 2.3.5 | 2.3.5 |