CVE-2024-22189

What it actually does

Allows remote attacker to exhaust peer memory by flooding NEW_CONNECTION_ID frames that retire connection IDs while suppressing the expected RETIRE_CONNECTION_ID responses through congestion window collapse via selective ACKs and RTT manipulation.

Why it matters to the business

Denial of service against any service using vulnerable quic-go, causing outages for QUIC-based applications with no available workarounds until patched.

How an attack unfolds

Attacker establishes a QUIC connection then sends a large volume of NEW_CONNECTION_ID frames; by selectively acknowledging packets the attacker shrinks the receiver congestion window and skews RTT estimates so that the vast majority of required RETIRE_CONNECTION_ID responses are never sent, accumulating memory until the peer OOMs.

How to fix it

Upgrade quic-go to version 0.42.0 or later (commit 4a99b816ae3ab03ae5449d15aac45147c85ed47a). No workarounds exist.

How to confirm the fix worked

Verify deployed quic-go version is at least 0.42.0; monitor process memory usage under sustained NEW_CONNECTION_ID load after upgrade to confirm stability.

Typical attack path

1. Establish QUIC connection to target
2. Transmit large numbers of NEW_CONNECTION_ID frames retiring old connection IDs
3. Selectively acknowledge received packets to collapse peer congestion window
4. Manipulate observed RTT to further delay or suppress responses
5. Continue frame flood until receiver memory exhaustion

How to detect it

Inspect QUIC connection logs or packet captures for abnormally high volumes of NEW_CONNECTION_ID frames without corresponding RETIRE_CONNECTION_ID responses; correlate with sudden memory growth in quic-go processes.

What your security team should do

• Immediately upgrade all quic-go deployments to 0.42.0 or newer
• Monitor memory consumption of QUIC services for anomalous growth
• Add rate limiting or connection ID retirement validation in front of unpatched instances if upgrade cannot be immediate