CVE-2024-22189— QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-22189
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack
Source: CVE Program / CVE List V5
Vulnerability Description
quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Vulnerability Title
quic-go 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
quic-go是Lucas Clemente个人开发者的一种 QUIC 协议、RFC 9000协议在 Go 中的实现。 quic-go 0.42.0之前版本存在安全漏洞。攻击者利用该漏洞可以发送大量 NEW_CONNECTION_ID 帧来淘汰旧的连接ID，导致其对等方耗尽内存。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-22189
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 9129 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2024-22189
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-22189 (1)
Security Blog Posts for CVE-2024-22189 (1)
Other References for CVE-2024-22189 (1)
- https://www.youtube.com/watch?v=JqXtYcZAtIA&t=3683sx_refsource_MISC
IV. Related Vulnerabilities
Same product: quic-go
- CVE-2026-40898
quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion - CVE-2025-64702
quic-go HTTP/3 QPACK Header Expansion DoS - CVE-2025-59530
quic-go has Client Crash Due to Premature HANDSHAKE_DONE Fra - CVE-2025-29785
quic-go Has Panic in Path Probe Loss Recovery Handling - CVE-2024-53259
quic-go affected by an ICMP Packet Too Large Injection Attac
Same vendor: quic-go
- CVE-2026-40898
quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion - CVE-2026-21438
webtransport-go affected by a Memory Exhaustion Attack due t - CVE-2026-21435
webtransport-go CloseWithError can block indefinitely - CVE-2026-21434
webtransport-go affected by Memory Exhaustion Attack due to - CVE-2025-64702
quic-go HTTP/3 QPACK Header Expansion DoS
Same weakness: CWE-770
- CVE-2026-72888
Net::OAuth versions before 0.32 for Perl allow memory exhaus - CVE-2026-74788
Scriban before 7.0.0 Denial of Service via string.pad_left/p - CVE-2026-74786
Scriban before 7.0.0 Denial of Service via Unbounded Templat - CVE-2026-74784
Scriban before 7.2.0 Denial of Service via array.insert_at - CVE-2026-73062
Scriban 3.0.0 through 7.2.0 Denial of Service via Array Mult
V. Comments for CVE-2024-22189
No comments yet