GitHub Advisoryadvisory · NuGet

GHSA-fr44-546p-7xcp MsQuic Remote Denial of Service Vulnerability

HIGH Published 2023-10-10 Modified 2024-06-03 Official page ↗
Aliases
CVE-2023-36435
Ecosystem
NuGet
Packages
Microsoft.Native.Quic.MsQuic.OpenSSL, Microsoft.Native.Quic.MsQuic.Schannel
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-401
Reviewed
2023-10-10

Affected packages

• NuGet Microsoft.Native.Quic.MsQuic.OpenSSL: < 2.2.3 → fixed in 2.2.3 • NuGet Microsoft.Native.Quic.MsQuic.Schannel: < 2.2.3 → fixed in 2.2.3

Description

Impact The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service. Patches The following patch was made: • Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb Workarounds Beyond upgrading to the patched versions, there is no other workaround.

Related

Alias · CVE (1)

  • CVE-2023-36435 Microsoft QUIC Denial of Service Vulnerability vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime weakness

References