CVE-2022-30591: Quic-Go Project Quic-Go

High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days.

quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs because mtu_discoverer.go misparses the MTU Discovery service and consequently overflows the probe timer. NOTE: the vendor's position is that this behavior should not be listed as a vulnerability on the CVE List

Affected products

• Quic-Go Project Quic-Go: up to and including 0.27.0

Published 2022-07-06. Last modified 2026-06-17.