GitHub Advisoryadvisory · NuGet

GHSA-2x7m-gf85-3745 Remote Denial of Service Vulnerability in Microsoft QUIC

HIGH Published 2024-03-13 Modified 2024-03-13 Official page ↗
Ecosystem
NuGet
Packages
Microsoft.Native.Quic.MsQuic.OpenSSL, Microsoft.Native.Quic.MsQuic.Schannel
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-401
Reviewed
2024-03-13

Affected packages

• NuGet Microsoft.Native.Quic.MsQuic.OpenSSL: < 2.1.12 → fixed in 2.1.12 • NuGet Microsoft.Native.Quic.MsQuic.Schannel: >= 2.2.0, < 2.2.7 → fixed in 2.2.7 • NuGet Microsoft.Native.Quic.MsQuic.Schannel: >= 2.3.0, < 2.3.5 → fixed in 2.3.5 • NuGet Microsoft.Native.Quic.MsQuic.Schannel: < 2.1.12 → fixed in 2.1.12 • NuGet Microsoft.Native.Quic.MsQuic.OpenSSL: >= 2.2.0, < 2.2.7 → fixed in 2.2.7 • NuGet Microsoft.Native.Quic.MsQuic.OpenSSL: >= 2.3.0, < 2.3.5 → fixed in 2.3.5

Description

Impact The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service. Patches The following patch was made: • Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9 Workarounds Beyond upgrading to the patched versions, there is no other workaround. MSRC CVE Info https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190

Related

Weakness · CWE (1)

  • CWE-401 Missing Release of Memory after Effective Lifetime weakness

References