{"id":"CVE-2022-30591","aliases":["DEBIAN-CVE-2022-30591","EUVD-2022-52434","GHSA-w2rh-hf85-pfh4"],"status":"disputed","title":"** DISPUTED ** quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU...","description":"quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs because mtu_discoverer.go misparses the MTU Discovery service and consequently overflows the probe timer. NOTE: the vendor's position is that this behavior should not be listed as a vulnerability on the CVE List","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02918,"percentile":0.87119,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-400"],"published":"2022-07-06T11:19:21Z","modified":"2026-11-03T06:02:16Z","exploits":[{"source":"pocgithub","id":"efchatz/QUIC-attacks","title":"efchatz/QUIC-attacks","date":"2022-06-30","url":"https://github.com/efchatz/QUIC-attacks"}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"golang-github-lucas-clemente-quic-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.29.0-1","0.29.2-1","0.29.2-2","0.29.2-3","0.37.0-1","0.37.4-1","0.37.4-1~bpo12+1","0.38.2-1","0.38.2-2","0.46.0-1","0.46.0-2","0.46.0-2~bpo12+1","0.50.0-1","0.50.1-1","0.50.1-2","0.54.0-1","0.54.0-2","0.54.0-3","0.54.1-1","0.55.0-1","0.59.0-1","0.59.0-2","0.59.0-2~bpo13+1","0.64.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-lucas-clemente-quic-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.50.1-2","0.54.0-1","0.54.0-2","0.54.0-3","0.54.1-1","0.55.0-1","0.59.0-1","0.59.0-2","0.59.0-2~bpo13+1","0.64.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-lucas-clemente-quic-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.50.1-2","0.54.0-1","0.54.0-2","0.54.0-3","0.54.1-1","0.55.0-1","0.59.0-1","0.59.0-2","0.59.0-2~bpo13+1","0.64.1-1"]}],"products":[{"vendor":"quic-go_project","product":"quic-go"}],"references":[{"url":"https://github.com/lucas-clemente/quic-go/blob/84e03e59760ceee37359688871bb0688fcc4e98f/mtu_discoverer.go","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30591","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w2rh-hf85-pfh4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30591.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-30591","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-30591","description":"quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs because mtu_discoverer.go misparses the MTU Discovery service and consequently overflows the probe timer. NOTE: the vendor's position is that this behavior should not be listed as a vulnerability on the CVE List","status":"disputed","published":"2022-07-06T11:19:21Z","modified":"2024-08-03T06:56:12.808Z","updated_at":"2026-11-02T14:34:31.184134Z"}],"euvd":[{"id":"EUVD-2022-52434","description":"quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs because mtu_discoverer.go misparses the MTU Discovery service and consequently overflows the probe timer. NOTE: the vendor's position is that this behavior should not be listed as a vulnerability on the CVE List","status":"published","published":"2022-07-06T11:19:21Z","modified":"2024-08-03T06:56:12Z","updated_at":"2026-11-03T03:25:35.869088Z"}],"ghsa":[{"id":"GHSA-w2rh-hf85-pfh4","title":"** DISPUTED ** quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU...","description":"** DISPUTED ** quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs because mtu_discoverer.go misparses the MTU Discovery service and consequently overflows the probe timer. NOTE: the vendor's position is that this behavior should not be listed as a vulnerability on the CVE List.","status":"published","published":"2022-07-07T00:00:27Z","modified":"2023-01-27T05:05:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:42:45.476861Z"}],"nvd":[{"id":"CVE-2022-30591","description":"quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs because mtu_discoverer.go misparses the MTU Discovery service and consequently overflows the probe timer. NOTE: the vendor's position is that this behavior should not be listed as a vulnerability on the CVE List","status":"disputed","published":"2022-07-06T12:15:08.173Z","modified":"2026-06-17T04:43:54.377Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:07:22.966735Z"}],"osv":[{"id":"DEBIAN-CVE-2022-30591","description":"quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs because mtu_discoverer.go misparses the MTU Discovery service and consequently overflows the probe timer. NOTE: the vendor's position is that this behavior should not be listed as a vulnerability on the CVE List","status":"published","published":"2022-07-06T12:15:08.173Z","modified":"2026-11-03T08:02:59.802235373Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"CVE-2022-30591","description":"quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs because mtu_discoverer.go misparses the MTU Discovery service and consequently overflows the probe timer. NOTE: the vendor's position is that this behavior should not be listed as a vulnerability on the CVE List","status":"published","published":"2022-07-06T11:19:21Z","modified":"2026-10-28T02:30:46.220913893Z","updated_at":"2026-11-02T15:44:25.516981Z"}]}}