quic-go vulnerable to pointer dereference that can lead to panic

CVE-2023-46239

What is CVE-2023-46239?

A significant vulnerability exists in the quic-go implementation of the QUIC protocol, affecting versions 0.37.0 through 0.37.2. An attacker can exploit this vulnerability by sending malicious packets that trigger a nil pointer dereference during the handshake process, leading to a node crash. This requires minimal effort and could allow an attacker to disrupt services using quic-go without needing sophisticated techniques. Version 0.37.3 provides a patch to mitigate this issue, and it is crucial for users to upgrade to this version to ensure system stability and security.

References