CVE-2023-46239: Quic-Go Project Quic-Go

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.

Affected products

• Quic-Go Project Quic-Go: from 0.37.0, before 0.37.3 (fixed in 0.37.3)

Published 2023-10-31. Last modified 2026-06-17.