{"id":"CVE-2023-46239","aliases":["GHSA-3q6m-v84f-6p9h","GO-2023-2160"],"title":"quic-go vulnerable to pointer dereference that can lead to panic","summary":"quic-go vulnerable to pointer dereference that can lead to panic","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"quic-go","product":"github.com/quic-go/quic-go","ecosystem":"go","affected":["github.com/quic-go/quic-go >= 0.37.0, < 0.37.3"],"patched":["github.com/quic-go/quic-go 0.37.3"],"published":"2023-10-30","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:24.666665738Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-3q6m-v84f-6p9h","references":[{"url":"https://github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9h"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46239"},{"url":"https://github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617"},{"url":"https://github.com/quic-go/quic-go"},{"url":"https://github.com/quic-go/quic-go/releases/tag/v0.37.3"}],"tags":["osv","go"],"epss":0.00765,"epssPercentile":0.535,"ingestedAt":"2026-09-12T03:13:01.749Z","slug":"CVE-2023-46239","body":"## Overview\n\nquic-go is an implementation of the [QUIC](https://datatracker.ietf.org/doc/html/rfc9000) transport protocol in Go. By serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space.\n\n**Impact**\n\nAn attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets.\n\n**Patches**\n\n[v0.37.3](https://github.com/quic-go/quic-go/releases/tag/v0.37.3) contains a patch. Versions before v0.37.0 are not affected.\n\n## Affected packages\n\n- `github.com/quic-go/quic-go >= 0.37.0, < 0.37.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/quic-go/quic-go 0.37.3`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}