CVE-2024-22189

CVE-2024-22189 is a denial-of-service vulnerability affecting quic-go, an implementation of the QUIC protocol in Go, prior to version 0.42.0. An unauthenticated attacker can exhaust a peer's memory by sending numerous NEW_CONNECTION_ID frames and manipulating the congestion window and RTT estimate to prevent the peer from responding with RETIRE_CONNECTION_ID frames. This vulnerability has a CVSS score of 7.5 (High), indicating a network-based attack with low complexity leading to high availability impact. There are no known workarounds, and while a patch is available in version 0.42.0, there is currently no evidence of active exploitation, public exploit code, or significant community discussion.