title: Memory exhaustion in QUIC connection handling in crypto/tls
description: QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.
problem types: CWE-400: Uncontrolled Resource Consumption
affected:
{
vendor: Go standard library
product: crypto/tls
collectionURL: https://pkg.go.dev
packageName: crypto/tls
versions:
version: 1.21.0-0, lessThan: 1.21.1, status: affected, versionType: semver
programRoutines:
name: QUICConn.HandleData
defaultStatus: unaffected
}