Description
quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| quic-go | quic-go | < 0.42.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-lucas-clemente-quic-go | 0.46.0-1 | — |
| Debian 13 | golang-github-lucas-clemente-quic-go | 0.46.0-1 | — |
| Debian 12 | golang-github-lucas-clemente-quic-go | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | golang-github-lucas-clemente-quic-go | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | receptor +1 | 1.4.9-2.el8ap | RHSA-2024:8534 |
| Red Hat Ansible Automation Platform Developer 2 | receptor +1 | 1.4.9-2.el8ap | RHSA-2024:8534 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.6.2-1.el8ap | RHSA-2024:8534 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.3-1.el8ap | RHSA-2024:8534 |
| Red Hat Ansible Automation Platform 2 | receptor +1 | 1.4.9-2.el8ap | RHSA-2024:8534 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP6 | caddy | 2.8.4-bp156.3.3.1 | openSUSE-SU-2024:0220-1 |
| SUSE Package Hub 15 SP6 | coredns | 1.11.3-bp156.4.3.1 | openSUSE-SU-2024:0319-1 |
| SUSE Package Hub 15 SP5 | caddy | 2.8.4-bp155.2.3.1 | openSUSE-SU-2024:0211-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | caddy | 2.8.4-1.1 | openSUSE-SU-2024:14014-1 |
| openSUSE Tumbleweed | coredns | 1.11.1-5.1 | openSUSE-SU-2024:13849-1 |
| openSUSE Tumbleweed | kubo | 0.27.0-2.1 | openSUSE-SU-2024:13845-1 |
| openSUSE Tumbleweed | syncthing | 1.27.6-1.1 | openSUSE-SU-2024:13847-1 |
| openSUSE Leap 16.0 | dnscrypt-proxy | 2.1.16-bp160.1.1 | openSUSE-RU-2026:21160-1 |
| openSUSE Leap 15.6 | caddy | 2.8.4-bp156.3.3.1 | openSUSE-SU-2024:0220-1 |
| openSUSE Leap 15.6 | coredns | 1.11.3-bp156.4.3.1 | openSUSE-SU-2024:0319-1 |
| openSUSE Leap 15.5 | caddy | 2.8.4-bp155.2.3.1 | openSUSE-SU-2024:0211-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | kubo | 0.28.0-r0 | — |
| Alpine v3.23 | kubo | 0.28.0-r0 | — |
| Alpine v3.22 | kubo | 0.28.0-r0 | — |
| Alpine v3.21 | kubo | 0.28.0-r0 | — |
| Alpine v3.20 | kubo | 0.28.0-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | coredns | 1.11.1-2 | — |
| Azure Linux 2 (CBL-Mariner) | coredns | 1.11.1-6 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | caddy | 2.7.6-r6 | — |
| Wolfi rolling | cloudflared | 2024.1.0-r7 | — |
| Wolfi rolling | k3s | 1.29.3-r3 | — |
| Wolfi rolling | q | 0.19.2-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/quic-go/quic-go | < 0.42.0 | 0.42.0 | GHSA-c33x-xqrf-c478 |
Advisories 10
- RHSA-2024:8534 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Release Update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- openSUSE-RU-2026:21160-1 Recommended update for dnscrypt-proxy SUSE / openSUSE Security Updates · Jun 30, 2026
- openSUSE-SU-2024:13847-1 syncthing-1.27.6-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13849-1 coredns-1.11.1-5.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:0220-1 Security update for caddy SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:0319-1 Security update for coredns SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13845-1 kubo-0.27.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:0211-1 Security update for caddy SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14014-1 caddy-2.8.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1474 Red Hat OpenShift Container Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2025