CVE-2023-46239High· 7.5▾ Twilightquic-go vulnerable to pointer dereference that can lead to panic
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.8%
quic-go is an implementation of the QUIC transport protocol in Go. By serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space.
Impact
An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets.
Patches
v0.37.3 contains a patch. Versions before v0.37.0 are not affected.
github.com/quic-go/quic-go >= 0.37.0, < 0.37.3Upgrade to a patched release:
github.com/quic-go/quic-go 0.37.3Connected by shared product, vendor, weakness, or advisory.
CVE-2025-59530High· 7.5quic-go: Panic occurs when queuing undecryptable packets after handshake completion
CVE-2026-40898Medium· 5.3quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion
CVE-2026-21438Medium· 5.3webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map
CVE-2026-57497Medium· 5.3webtransport-go is an implementation of the WebTransport protocol