high 7.5

CVE-2023-39322 json

Memory exhaustion in QUIC connection handling in crypto/tls

published 2023-09-07 3 y ago modified 2026-09-08 2 mo ago also BIT-golang-2023-39322 , EUVD-2023-43054 , GO-2023-2045

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.3%; EPSS 1.3% chance of exploitation in 30 days, percentile 71%
public exploits: 0; none known

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

Patch / fix

fixed in 4 distros 6 links 1

bitnami golang 1.21.1
go stdlib 1.21.1
Go standard library crypto/tls 1.21.1
go_standard_library crypto_tls 1.21.1

red hat suse opensuse almalinux rocky linux alpine

git-lfs RHEL 9 3.6.1-1.el9
crit RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
criu RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
crun RHEL 8 1.14.3-2.module+el8.10.0+21340+c6c7475a
runc RHEL 8 1:1.1.12-1.module+el8.10.0+21251+62b7388c
udica RHEL 8 0.2.6-20.module+el8.9.0+20326+387084d0
conmon RHEL 8 3:2.1.10-1.module+el8.10.0+21077+98b84d8a
podman RHEL 8 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1

red hat advisories RHSA-2025:7256 RHSA-2024:2988 RHSA-2024:0121 RHBA-2023:6928 RHSA-2023:6840 RHSA-2023:5009

go1.21-openssl SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.21.4.1-150000.1.5.1
go1.21 SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.21.1-150000.1.6.1

suse advisories SUSE-SU-2023:4469-1 SUSE-SU-2023:3701-1

go1.21 Package Hub 12 1.21.3-2.1
go Package Hub 12 1.21-41.1

opensuse advisories openSUSE-SU-2023:0360-1

git-lfs AlmaLinux 9 3.6.1-1.el9
crit AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
crit AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
criu AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
criu AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
crun AlmaLinux 8 1.8.7-1.module_el8.9.0+3683+33eb0feb
runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3627+db8ec155
runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3687+dcd7ef8f

almalinux advisories ALSA-2025:7256 ALSA-2024:0121 ALSA-2023:7762 ALSA-2023:7763 ALSA-2023:7764 ALSA-2023:7765

git-lfs Rocky Linux 9 3.6.1-1.el9
criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
runc Rocky Linux 8 1:1.1.5-2.module+el8.9.0+1445+07728297
udica Rocky Linux 8 0.2.6-4.module+el8.9.0+1445+07728297
conmon Rocky Linux 8 2:2.1.4-2.module+el8.9.0+1445+07728297
skopeo Rocky Linux 8 2:1.6.2-9.module+el8.9.0+1578+aa900b44
buildah Rocky Linux 8 1:1.24.6-7.module+el8.9.0+1445+07728297
libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297

rocky linux advisories RLSA-2025:7256 RLSA-2024:0121 RLSA-2024:2988

go Alpine 3.18 1.20.8-r0
go Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 1.21.1-r0

alpine advisories ALPINE-CVE-2023-39322

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

go.dev/cl/523039 patch

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-39322 updated 2026-11-07 cvss 7.5

golang: crypto/tls: lack of a limit on buffered post-handshake

Red Hat Cost Management Metrics Operator costmanagement/costmanagement-metrics-rhel8-operator Red Hat mirror registry for Red Hat OpenShift mirror-registry-container Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator Red Hat OpenShift Developer Tools and Services helm, ocp-tools-4/jenkins-rhel8 Red Hat OpenShift Pipelines openshift-pipelines-client
affected: no fix available
Red Hat OpenShift Serverless openshift-serverless-clients, openshift-serverless-1/kn-client-kn-rhel9
affected: no fix planned “Will not fix”
Red Hat 3scale API Management Platform 2 3scale-amp26/3scale-operator
affected: no fix available
Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8
affected: no fix planned “Will not fix”
Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8 Red Hat build of Apicurio Registry 2 openshift-service-mesh/istio-rhel9-operator
affected: no fix available
Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
affected: no fix planned “Out of support scope”
Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-cnf, redhat-certification-preflight Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-cnf, redhat-certification-preflight
affected: no fix available “Fix deferred”
Red Hat Enterprise Linux 8 git-lfs, osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json Red Hat Enterprise Linux 9 butane, conmon, toolbox, ignition, ignition-edge, ignition-grub, +6 more
affected: no fix planned “Will not fix”

show 17 more

Red Hat OpenShift Container Platform 4 ignition, ignition-validate, sandboxed-containers
affected: no fix available, no fix planned “Will not fix”
Red Hat OpenShift Data Science (RHODS) rhods/odh-mm-rest-proxy-rhel8
affected: no fix planned “Will not fix”
Red Hat OpenShift Dev Spaces devspaces/udi-rhel8 Red Hat OpenShift distributed tracing 2 rhosdt/tempo-rhel8 Red Hat OpenShift GitOps openshift-gitops-kam, openshift-gitops-1/gitops-rhel8 Red Hat OpenShift on AWS rosa Red Hat OpenShift Virtualization 4 kubevirt, openshift-golang-builder-container Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent
affected: no fix available
Red Hat OpenStack Platform 17.0 collectd-libpod-stats, golang-github-infrawatch-apputils
affected: no fix planned “Out of support scope”
Red Hat OpenStack Platform 17.1 collectd-libpod-stats
affected: no fix available
Red Hat OpenStack Platform 18.0 collectd-libpod-stats, rhoso-operators/ovn-rhel9-operator
affected: no fix available, no fix planned “Will not fix”
Red Hat Quay 3 quay/clair-rhel8 Red Hat Satellite 6 yggdrasil-worker-forwarder
affected: no fix available
Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests, go-toolset-7-golang
affected: no fix planned “Will not fix”
Red Hat Web Terminal web-terminal/web-terminal-rhel9-operator Red Hat Self Node Remediation Operator workload-availability/self-node-remediation-rhel8-operator Red Hat Service Telemetry Framework 1.5 stf/sg-core-rhel8
affected: no fix available
Red Hat Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-rhel8-operator 2.3.1-11
fixed: vendor fix RHSA-2023:6031
Red Hat LVMS 4.14 for RHEL 9 lvms4/topolvm-rhel9 v4.14.1-2, lvms4/lvms-rhel9-operator v4.14.1-3, lvms4/lvms-operator-bundle v4.14.1-4, lvms4/lvms-must-gather-rhel9 v4.14.1-3
fixed: vendor fix RHBA-2023:6863
Red Hat Migration Toolkit for Virtualization 2.5 migration-toolkit-virtualization/mtv-api-rhel9 2.5.3-11
fixed: vendor fix RHBA-2023:7648
Red Hat NETOBSERV 1.4 for RHEL 9 network-observability/network-observability-rhel9-operator v1.4.0-51
fixed: vendor fix RHSA-2023:5974
Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-velero-rhel8 1.1.7-6
fixed: vendor fix RHSA-2023:6115
Red Hat OSSO 1.2 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-bundle v1.2-8, openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8 v1.2-13
fixed: vendor fix RHSA-2023:6154
Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/search-rhel8 v2.6.8-7, rhacm2/thanos-rhel8 v2.6.8-5, rhacm2/console-rhel8 v2.6.8-7, rhacm2/memcached-rhel8 v2.6.8-5, rhacm2/prometheus-rhel8 v2.6.8-5, rhacm2/search-api-rhel8 v2.6.8-4, +42 more
fixed: vendor fix RHSA-2023:6202
Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor 1.4.3-1.el8ap
fixed: vendor fix RHSA-2023:7517

10 more fixed, 21 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-09-26)

Exploit prediction

1.34% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
bitnami	golang	>=1.21.0, <1.21.1	1.21.1
go	stdlib	>=1.21.0-0, <1.21.1	1.21.1

Affected products

Go standard library crypto/tls
go_standard_library crypto_tls

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling

References

go.dev /cl/523039
patch
pkg.go.dev /vuln/GO-2023-2045
vendor-advisory, advisory
go.dev /issue/62266
issue-tracking, report
groups.google.com /g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
mailing-list, release-notes, discussion, web
security.netapp.com /advisory/ntap-20231020-0004/
third-party-advisory, advisory
security.gentoo.org /glsa/202311-09
web
nvd.nist.gov /vuln/detail/CVE-2023-39322
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary