CVE-2023-46239 quic-go vulnerable to pointer dereference that can lead to panic

What is CVE-2023-46239?

CVE-2023-46239 is a high-severity vulnerability in quic-go, published on 31 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.

Weakness: CWE-476, CWE-248

Which versions are affected by CVE-2023-46239?

3 open source packages ship an affected version, including github.com/quic-go/quic-go. It affects 1 product.

Products include Quic-Go Project Quic-Go.

How do I fix CVE-2023-46239?

Upgrade github.com/quic-go/quic-go to 0.37.3 or later.

Is CVE-2023-46239 being exploited?

There is no known exploitation of CVE-2023-46239 in the wild and no public exploit code.

Other vulnerabilities in quic-go

• CVE-2022-30591 Denial of service in n/a High 7.5
• CVE-2023-49295 quic-go's path validation mechanism can cause denial of service Medium 6.4
• CVE-2026-40898 quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion Medium 5.3
• CVE-2025-64702 quic-go HTTP/3 QPACK Header Expansion DoS Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3q6m-v84f-6p9h, GO-2023-2160, UBUNTU-CVE-2023-46239.