CVE-2023-39322 (published 2023-09-08T16:13:32.795Z)
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.
Affected products: Vendor: Go standard library
Product: crypto/tls
Versions: 1.21.0-0