7.5

CVE-2024-22189: QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

Deferred
AliasesUBUNTU-CVE-2024-22189DEBIAN-CVE-2024-22189CGA-39xh-hgqh-9p3g
Published 04-04-2024Last modified 23-08-2024

Vulnerability summary

CVE-2024-22189 is a high (CVSS 7.5) vulnerability in quic-go. EPSS estimates a 1.11% chance of exploitation in the next 30 days, higher than 65.9% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.11%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 15
OPENSUSE-RU-2026:21160-1OPENSUSE-SU-2024:0211-1OPENSUSE-SU-2024:0220-1OPENSUSE-SU-2024:0319-1RHSA-2024:8534CGA-23GR-PH4G-W7PJ

Timeline

  1. 04-04-2024
    PublishedVulnerability first disclosed.
  2. 23-08-2024
    Last modifiedVulnerability information updated.

Description

quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

1.11%

Chance of exploitation in the next 30 days

Percentile

66%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.11% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard5 products
  • caddy< 2.7.6-r6
  • caddy-fips< 2.7.6-r4
  • cloudflared< 2024.1.0-r7
  • k3s< 1.29.3-r3
  • q< 0.19.2-r2
Opensuse4 products
  • caddy&distro=openSUSE Tumbleweed< 2.8.4-1.1
  • coredns&distro=openSUSE Tumbleweed< 1.11.1-5.1
  • kubo&distro=openSUSE Tumbleweed< 0.27.0-2.1
  • syncthing&distro=openSUSE Tumbleweed< 1.27.6-1.1
Wolfi4 products
  • caddy< 2.7.6-r6
  • cloudflared< 2024.1.0-r7
  • k3s< 1.29.3-r3
  • q< 0.19.2-r2
Alpine1 product
  • kubo< 0.28.0-r0
Debian1 product
  • golang-github-lucas-clemente-quic-goAll versions (No fix recorded) | < 0.46.0-1
Github.com/quic-go1 product
  • quic-go< 0.42.0
Quic-go1 product
Ubuntu1 product
  • golang-github-lucas-clemente-quic-goAll versions (No fix recorded)

8 vendors · 18 products

References

12 links
Show all 12 references