Memory exhaustion in QUIC connection handling in crypto/tls

CVE-2023-39322

What is CVE-2023-39322?

The vulnerability arises from QUIC connections lacking an upper limit on the data buffered when processing post-handshake messages. This oversight permits a malicious QUIC connection to exploit the system, leading to unbounded memory growth. The issue has been addressed in recent updates, which now enforce a restriction on message size at 65KiB, effectively mitigating the potential for excessive resource consumption and maintaining system integrity.

References