← Vulnerability feed

Vulnerability record · CVE-2023-46239 · published 31 October 2023

CVE-2023-46239: Quic-go project quic-go null pointer dereference vulnerability

Quic Go Project · Quic Go

quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.

7.5 CVSS 3.1 High EPSS 0.77% · top 46.3% CWE-248 · CWE-248CWE-476 · NULL pointer dereference
7.5CVSS 3.1 base score
0.77%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617 Patch
https://github.com/quic-go/quic-go/releases/tag/v0.37.3 Release Notes
https://github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9h PatchVendor Advisory
https://github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617 Patch
https://github.com/quic-go/quic-go/releases/tag/v0.37.3 Release Notes
https://github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9h PatchVendor Advisory

Track CVE-2023-46239 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-40898Quic-go project quic-go allocation without limits vulnerabilityquic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP…EPSS 0.49%7.5CVE-2022-30591Quic-go project quic-go uncontrolled resource consumption vulnerabilityquic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTT…EPSS 2.9%6.5CVE-2023-49295Quic-go project quic-go uncontrolled resource consumption vulnerabilityquic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a…EPSS 1.2%5.3CVE-2025-64702Quic-go project quic-go allocation without limits vulnerabilityquic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HT…EPSS 0.36%

Source: NIST National Vulnerability Database (record CVE-2023-46239), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.