---
id: CVE-2023-46239
aliases:
  - GHSA-3q6m-v84f-6p9h
  - GO-2023-2160
title: quic-go vulnerable to pointer dereference that can lead to panic
summary: quic-go vulnerable to pointer dereference that can lead to panic
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: quic-go
product: github.com/quic-go/quic-go
ecosystem: go
affected:
  - 'github.com/quic-go/quic-go >= 0.37.0, < 0.37.3'
patched:
  - github.com/quic-go/quic-go 0.37.3
published: '2023-10-30'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:24.666665738Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3q6m-v84f-6p9h'
references:
  - url: 'https://github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9h'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-46239'
  - url: >-
      https://github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617
  - url: 'https://github.com/quic-go/quic-go'
  - url: 'https://github.com/quic-go/quic-go/releases/tag/v0.37.3'
tags:
  - osv
  - go
epss: 0.00765
epssPercentile: 0.53966
ingestedAt: '2026-09-12T03:13:01.749Z'
---

## Overview

quic-go is an implementation of the [QUIC](https://datatracker.ietf.org/doc/html/rfc9000) transport protocol in Go. By serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space.

**Impact**

An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets.

**Patches**

[v0.37.3](https://github.com/quic-go/quic-go/releases/tag/v0.37.3) contains a patch. Versions before v0.37.0 are not affected.

## Affected packages

- `github.com/quic-go/quic-go >= 0.37.0, < 0.37.3`

## Remediation

Upgrade to a patched release:

- `github.com/quic-go/quic-go 0.37.3`