Not rated
CVE-2023-39322 QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing…
Description
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| crypto/tls 1.21 | 1.21.0-0 → < 1.21.1 | 1.21.1 |
| crypto_tls 1.21 | 1.21.0-0 → < 1.21.1 | 1.21.1 |
Other CVEs of crypto/tls
The 13 CVEs of crypto/tls →
CVE-2026-97031
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted…
7.5
High
CVE-2026-56862
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has…
7.5
High
CVE-2026-42505
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of…
5.3
Medium
CVE-2026-32283
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection…
7.5
High